[Feature Request] No research blueprint family — the README names universities as a target audience, every blueprint is FedRAMP High, FedRAMP Moderate or IL5

[WandLZhang]

Feature Description

A blueprints/research/ family for the unspecified regime, aimed at universities and research institutions.

Use Case

The README lists "Educational and Research Institutions" under Target Audience. Every shipped blueprint targets FedRAMP High, FedRAMP Moderate or IL5. A university running NSF or NIH work usually has no Assured Workloads requirement, so it pays the compliance overhead and gets nothing back.

Three gaps show up on every deployment I do:

1. Egress. Researchers run pip install, pull from HuggingFace, and fetch datasets from Zenodo and nf-core. An inspected-egress topology blocks all of it. Per-spoke Cloud NAT lets it through.
2. Who creates projects. Central IT on the critical path for every new principal investigator (PI) project works for ten researchers and fails at hundreds.
3. Blast radius. A PI who needs a public IP for one sandbox VM shouldn't need an org-wide policy change.

Proposed Solution

A blueprint family covering: NCC egress (see #58), department folders with tag-scoped org-policy delegation (see #14), sandbox and hardened folder presets (see #12), and project templates for each.

I have all of it deployed in a fork and can contribute it. Opening this first to check you want the family at all, and where it should live, before sending PRs against the three issues separately.

Compliance & Deployment Context

• Target Deployment Type(s):
  • All / General — specifically the unspecified regime, where no Assured Workloads folder is created.
• Relevant NIST 800-53r5 Controls: Not compliance-driven. The delegation piece touches AC-6 (least privilege) by replacing org-wide policy admin with folder-scoped grants.

Reusability Check

• I have checked if this functionality can be achieved by extending an existing module or blueprint.
• I have verified that this does not duplicate existing functionality.

Alternatives Considered

Leaving it in its current fork.

Additional Context

Related: #58, #14, #12.