chore(cli): async and predicate-based CliIoHost message listeners

[mrgrain]

Internal only, with no user-facing CLI behavior changes. CliIoHost and IoHostRecorder are CLI-internal (the recorder is a test helper, and the .is addition lives in toolkit-lib's private path). This is groundwork for rerouting CLI commands through toolkit-lib, plus a more robust IO snapshot harness.

on/once listeners may now be async (awaited in registration order) and may select messages by a custom predicate, such as a maker's .is, in addition to a code. Request makers gain the same .is guard. matchAny composes selectors, and removeAllListeners resets user listeners while keeping the host's internal ones.

respond and preventDefault are now orthogonal. preventDefault means the listener handled it: a notification is not written, and a request skips its prompt silently and resolves with the default. A respond value is folded into the request's default response and skips the prompt, but still surfaces the question unless preventDefault is also set; respond/respondOnce expose this via a suppressQuestion flag. Separating the two lets a listener suppress output, answer, or both, without one implying the other.

IoHostRecorder now captures the stream via observeMessages instead of spying on the host. The spy approach was neutralised by the jest.resetAllMocks() in command tests, which stopped the real notify/requestResponse from running and caused order-dependent failures unless each test re-established pass-through by hand. Observing removes that entirely, so tests answer prompts through respondOnce with no boilerplate. Destroy snapshots are re-baselined to tag every line with the destroy action the real command emits.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

❌ Patch coverage is 99.63235% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.29%. Comparing base (dd4080e) to head (f4955f5).

Files with missing lines	Patch %	Lines
packages/aws-cdk/lib/cli/io-host/cli-io-host.ts	99.63%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1679      +/-   ##
==========================================
+ Coverage   89.14%   89.29%   +0.14%     
==========================================
  Files          77       77              
  Lines       11539    11716     +177     
  Branches     1605     1620      +15     
==========================================
+ Hits        10287    10462     +175     
- Misses       1221     1223       +2     
  Partials       31       31              

Flag	Coverage Δ
suite.unit	89.29% <99.63%> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.