feat(rules): add NAT gateway and SageMaker discovery checks

[axonstone]

Summary

• What changed?
  • Added AWS discovery dataset support and built-in rules for idle NAT Gateways and running SageMaker notebook instances.
  • Registered the new datasets and rules, added hydrators and evaluators, updated docs, and added changesets for @cloudburn/sdk and @cloudburn/rules.
• Why was this needed?
  • The ruleset already covered adjacent AWS waste checks, but it was still missing discovery coverage for two findings supported by the reference WasteFinder logic: idle NAT Gateways and running SageMaker notebooks.

Diagram

flowchart LR
  RE["AWS Resource Explorer catalog"] --> NAT["ec2:natgateway"]
  RE --> SM["sagemaker:notebook-instance"]
  NAT --> H1["SDK NAT hydrator\nDescribeNatGateways + CloudWatch metrics"]
  SM --> H2["SDK SageMaker hydrator\nDescribeNotebookInstance"]
  H1 --> D1["aws-ec2-nat-gateway-activity"]
  H2 --> D2["aws-sagemaker-notebook-instances"]
  D1 --> R1["CLDBRN-AWS-EC2-10"]
  D2 --> R2["CLDBRN-AWS-SAGEMAKER-1"]

Loading

Scope

• cloudburn (cli)
• @cloudburn/sdk
• @cloudburn/rules
• docs/community files

Release Notes

• Added a .changeset/*.md file for published package changes
• No published package changes in this PR

Verification

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm verify

Boundary Checks

• No engine/parser/provider logic added to @cloudburn/rules
• CLI delegates scan logic to SDK
• README/CONTRIBUTING/docs updated when behavior changed

---