feat: map observability requirements for aws

[intel352]

Summary

• add the strict-proto IaCProviderRequirementMapper service for AWS observability requirements
• map OTel, Datadog, Prometheus, Loki, and Grafana backends to a generic ECS AWS OTel Collector service
• carry satisfies keys through derived modules so explicit YAML can override generated IaC
• teach the ECS driver to apply collector command, env vars, secret refs, and port mappings
• embed plugin.json into the binary and update release/CI wfctl versions to v0.64.3

TDD proof

With production/config changes reverted and tests kept:

$ GOWORK=off go test ./cmd/workflow-plugin-aws ./internal ./drivers -run 'TestAWSRequirementMapper|TestPluginManifestAdvertisesRequirementMapper|TestECSDriver_Create_CollectorConfig' -count=1
FAIL — mapper proto/version support unavailable and ECS collector command mapping missing

With fix restored:

$ GOWORK=off go test ./cmd/workflow-plugin-aws ./internal ./drivers -run 'TestAWSRequirementMapper|TestPluginManifestAdvertisesRequirementMapper|TestECSDriver_Create_CollectorConfig' -count=1
PASS

Verification

$ GOWORK=off go test ./... -count=1
PASS

$ GOWORK=off go test -race ./... -count=1
PASS

$ GOWORK=off go vet ./...
PASS

$ GOWORK=off go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.64.3 plugin validate --file plugin.json --strict-contracts
OK workflow-plugin-aws v0.0.0 (plugin.json)

$ GOWORK=off go build -ldflags='-X github.com/GoCodeAlone/workflow-plugin-aws/provider.ProviderVersion=0.1.0 -X github.com/GoCodeAlone/workflow-plugin-aws/internal.Version=0.1.0' -o /tmp/workflow-plugin-aws ./cmd/workflow-plugin-aws
$ GOWORK=off go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.64.3 plugin verify-capabilities --binary /tmp/workflow-plugin-aws .
OK workflow-plugin-aws 0.1.0 (plugin.json: 0.0.0)

Notes

ECS task sidecars require knowing the target app service. The mapper emits a generic collector ECS service and returns a note explaining that applications can override with an explicit infra.container_service using the same satisfies keys when they need per-task sidecars.