The €15M Question Your Board Will Ask You in 2026: A CTO's Guide to the EU Cyber Resilience Act