fix(deploy-on-aws): repair defusedxml diagram fixers

[shakirjames]

Summary

• postpone runtime annotation evaluation in all four draw.io fixer modules so defusedxml.ElementTree remains the parser without resolving exports it does not provide
• replace the unavailable ET.indent call with a small parser-free formatter and make the dynamic loader safe for postponed dataclass annotations
• add regression coverage to the existing mise run validate path, with no new dependency

Problem

With the declared defusedxml>=0.7.1 dependency, the shipped diagram entrypoints fail at import time because defusedxml.ElementTree does not expose Element, ElementTree, or indent. This makes the deploy-on-aws post-processing hook fail before it can validate a generated diagram.

This addresses the runtime failure described in #154 and #167 and supersedes the closed approach in #172 without monkeypatching parser exports or reintroducing an unsafe parser import.

Verification

• mise run validate
• mise run lint
• mise run fmt:check
• focused unittest suite: 4 passed
• Ruff 0.15.0: clean
• Bandit 1.9.3: clean
• vendored Semgrep scan: 789 rules, 0 findings
• all four shipped entrypoints executed successfully with defusedxml==0.7.1
• the shipped hook post-processed and validated a real 2,188 x 904 AWS draw.io diagram end to end

A complete local mise run build could not start because the temporary Mise bootstrap rejected its uv release attestation. The exact lint, validation, formatting, focused security, and real-diagram checks above were run directly; canonical GitHub CI remains the package-wide build authority.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.