feat(aws): add ignore_tags to preserve customer-applied resource tags

[Lytol]

Description

Adds a per-target ignore_tags option: a flat list of exact AWS tag keys that
PTD's IaC must never add or remove on managed resources. This lets customers (or
an org-wide tagging policy) apply their own tags to resources PTD manages without
our ptd ensure reverting them.

AWS-only. Azure config is intentionally not given the field (the azure-native
provider has no equivalent, and aws:ignoreTags is provider-namespaced so it
cannot affect Azure resources).

Code Flow

• Config: IgnoreTags []string (ignore_tags) added to AWSWorkloadConfig
  and AWSControlRoomConfig (lib/types). Exposed on the Target interface as
  IgnoreTags(); implemented on the AWS target (threaded through NewTarget),
  the Azure target returns nil. Plumbed from config in
  cmd/internal/legacy/ptd_config.go.
• Default provider: ConfigureStackRegion (lib/pulumi/common.go) sets
  aws:ignoreTags.keys[i] as nested path config, fed from StackConfig.IgnoreTags
  in inline.go. Applies to every resource on the ambient AWS provider.
• Explicit provider: the WorkSpaces use1 (us-east-1) provider gets
  IgnoreTags on its args when set.
• Refresh: RefreshStack (lib/pulumi/pulumi.go) passes
  optrefresh.RunProgram(true) only when the stack has aws:ignoreTags
  configured. Required: without re-running the program, pulumi refresh reuses
  the provider config from the last up, so ignoreTags is inert on refresh
  (Use new provider version or config during refresh pulumi/pulumi#13860). The gate leaves refresh behavior unchanged for every
  workload that does not use the feature.

Rollout / adoption caveats

ignoreTags is enforced at the AWS-provider level and only takes effect once a
state-persisting ptd ensure (an apply) has registered it on the target's
provider — the run that first registers it still plans against the previous
provider ("one operation late"). Consequences, verified end-to-end on staging:

• Clean adoption is safe. Registering ignoreTags while the target's state
  has no matching tag is a no-op for resources; afterwards, customer tags added
  out-of-band are filtered on every ptd ensure (including --refresh) — never
  added, removed, or pulled into state.
• A tag already tracked in Pulumi state is stripped once on the registering
  apply (a prior --refresh is how such a tag gets into state). This is
  detectable: ptd ensure <target> --dry-run shows - <key> for exactly these
  targets. Handle them by clearing the key from state first (a state-only
  ensure --refresh, which does not touch AWS), then apply.
• Fleet rollout: run ptd ensure across targets while their state is clean
  of the configured keys (use the --dry-run check to catch any that are not).
• A key added to ignore_tags later needs another registering ptd ensure on
  then-clean state before it is protected.

See the "Adopting ignore_tags on an existing target" section in
docs/CONFIGURATION.md for the step-by-step runbook.

Category of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have reviewed my own diff and added inline comments on lines I want reviewers to focus on or that I am uncertain about