chore(toolkit): enforce all imports from aws-cdk are via one file (#33145)

### Reason for this change

We bundle `aws-cdk` into that file and if we don't load everything
through it, imports will fail.

### Description of changes

Fix the wrong import and add a linter rule to enforce it.

### Describe any new or updated permissions being added

n/a

### Checklist
- [x] My code adheres to the [CONTRIBUTING
GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and
[DESIGN
GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license*

Author: mrgrain

packages/@aws-cdk/toolkit/.eslintrc.js

@@ -10,4 +10,13 @@ baseConfig.overrides.push({
   },
 });
 
+// all aws-cdk files must be loaded through lib/api/aws-cdk.ts
+baseConfig.rules['import/no-restricted-paths'] = ['error', {
+  zones: [{
+    target: './',
+    from: '../../aws-cdk',
+    message: "All `aws-cdk` code must be used via lib/api/aws-cdk.ts",
+  }]
+}];
+
 module.exports = baseConfig;

packages/@aws-cdk/toolkit/lib/api/aws-cdk.ts

@@ -1,3 +1,5 @@
+/* eslint-disable import/no-restricted-paths */
+export { formatErrorMessage } from '../../../../aws-cdk/lib/util/error';
 export { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider } from '../../../../aws-cdk/lib/api';
 export type { SuccessfulDeployStackResult } from '../../../../aws-cdk/lib/api';
 export { formatSdkLoggerContent } from '../../../../aws-cdk/lib/api/aws-auth/sdk-logger';

packages/@aws-cdk/toolkit/lib/toolkit/toolkit.ts

@@ -4,7 +4,6 @@ import * as chalk from 'chalk';
 import * as chokidar from 'chokidar';
 import * as fs from 'fs-extra';
 import { ToolkitServices } from './private';
-import { formatErrorMessage } from '../../../../aws-cdk/lib/util/error';
 import { AssetBuildTime, DeployOptions, RequireApproval } from '../actions/deploy';
 import { buildParameterMap, removePublishedAssets } from '../actions/deploy/private';
 import { DestroyOptions } from '../actions/destroy';
@@ -15,7 +14,7 @@ import { RollbackOptions } from '../actions/rollback';
 import { SynthOptions } from '../actions/synth';
 import { patternsArrayForWatch, WatchOptions } from '../actions/watch';
 import { SdkOptions } from '../api/aws-auth';
-import { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider, SuccessfulDeployStackResult, StackCollection, Deployments, HotswapMode, StackActivityProgress, ResourceMigrator, obscureTemplate, serializeStructure, tagsForStack, CliIoHost, validateSnsTopicArn, Concurrency, WorkGraphBuilder, AssetBuildNode, AssetPublishNode, StackNode } from '../api/aws-cdk';
+import { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider, SuccessfulDeployStackResult, StackCollection, Deployments, HotswapMode, StackActivityProgress, ResourceMigrator, obscureTemplate, serializeStructure, tagsForStack, CliIoHost, validateSnsTopicArn, Concurrency, WorkGraphBuilder, AssetBuildNode, AssetPublishNode, StackNode, formatErrorMessage } from '../api/aws-cdk';
 import { CachedCloudAssemblySource, IdentityCloudAssemblySource, StackAssembly, ICloudAssemblySource, StackSelectionStrategy } from '../api/cloud-assembly';
 import { ALL_STACKS, CloudAssemblySourceBuilder } from '../api/cloud-assembly/private';
 import { ToolkitError } from '../api/errors';