feat(cli): add cdk deploy --method=execute-change-set for two-step deployment workflows

[mrgrain]

Two-step deployment workflows with --method=execute-change-set

Problem

CDK supports creating change sets without executing them via --method=prepare-change-set, but there is no way to execute those change sets through CDK afterwards. Users who want a review-then-deploy workflow — common in regulated environments and CI/CD pipelines with manual approval gates — have to drop down to raw CloudFormation API calls or the AWS Console to execute the change set. This breaks the CDK abstraction and loses CDK's progress monitoring, approval prompts, and error handling.

Use case

Teams that require human review of infrastructure changes before deployment need a complete workflow within CDK:

$ cdk deploy MyStack --method=prepare-change-set
# → Change set created, stack in REVIEW_IN_PROGRESS

# Review in AWS Console, run compliance checks, get approval...

$ cdk deploy MyStack --method=execute-change-set
# → Executes the change set with CDK's progress monitoring

This is especially valuable for:

• Regulated environments where infrastructure changes require explicit approval before execution
• CI/CD pipelines with separate "plan" and "apply" stages (similar to Terraform's workflow)
• Team workflows where one person prepares changes and another approves and executes them

What this PR does

• Adds --method=execute-change-set to cdk deploy
• Defaults the change set name to cdk-deploy-change-set (matching prepare-change-set), so the simplest workflow needs no extra flags
• Shows an accurate diff based on the actual change set during the approval prompt
• Rejects options that only apply to change set creation (--force, --parameters, --import-existing-resources, --revert-drift) with clear errors
• Requires exactly one stack name
• Exposes ExecuteChangeSetDeployment as part of the public DeploymentMethod type in @aws-cdk/toolkit-lib

---

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

❌ Patch coverage is 92.10526% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.31%. Comparing base (cd9585b) to head (ebf5b3f).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/aws-cdk/lib/cli/cli.ts	85.71%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1271      +/-   ##
==========================================
+ Coverage   88.14%   88.31%   +0.17%     
==========================================
  Files          74       74              
  Lines       10481    10541      +60     
  Branches     1432     1452      +20     
==========================================
+ Hits         9238     9309      +71     
+ Misses       1216     1204      -12     
- Partials       27       28       +1     

Flag	Coverage Δ
suite.unit	88.31% <92.10%> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[otaviomacedo]

Is the change set name mandatory?

[mrgrain]

@otaviomacedo it's optional, see next line:

A custom change set name can be provided with --change-set-name in both steps.

[garysassano]

This is a nice addition, but it doesn't address the core issue raised in #1123. Ideally, there should be a more restrictive role that can prepare the changeset without having permission to also execute it.