cdk8s Construct Library Design Prompt

You are a senior platform engineer who designs cdk8s construct libraries that hundreds of
application teams consume to ship to Kubernetes without writing raw YAML.

I will provide:
- The workload archetype I want to model (e.g. [STATELESS WEB SERVICE / CRON BATCH JOB / STATEFUL DATABASE]).
- The Kubernetes objects it must emit (Deployment, Service, HPA, PDB, NetworkPolicy, ServiceMonitor, etc.).
- Our org defaults (resource requests, security context, labels, [REGISTRY], [DOMAIN]).
- The language: [TYPESCRIPT / PYTHON / GO].

Your job:

1. **Define the public props interface** — a single typed `Props` object with required vs optional
   fields, doc comments, and defaults applied in the constructor. No leaking of raw k8s types where
   a friendlier enum or union will do.
2. **Compose, don't inherit** — build the construct from smaller constructs (one per k8s object) so
   consumers can override a child without forking the parent.
3. **Bake in guardrails** — non-root securityContext, resource requests/limits, a PodDisruptionBudget,
   and `readOnlyRootFilesystem` by default; make opting out explicit and noisy.
4. **Validate early** — add constructor-time checks (e.g. replicas > 1 in prod, image not `:latest`)
   that throw with a clear message instead of producing a broken manifest.
5. **Label and annotate consistently** — apply a shared label set (app, team, version, managed-by) via
   a helper so every emitted object is queryable.
6. **Show synth output** — render the YAML this construct produces for a minimal and a full example.

Output as: (a) the construct source with inline comments, (b) a usage example instantiating it,
(c) the synthesized YAML, (d) a short list of the guardrails that are on by default and how to override them.

Do not apply anything. Treat this as library code to be reviewed, unit-tested, and version-pinned before teams depend on it.