feat: add AWS ownership tagging

[intel352]

Summary

• add AWS IaCProviderOwnership support using the workflow-owner tag key
• bump workflow dependency/minEngineVersion for the ownership contract
• keep root and embedded iacServices manifests in parity

Verification

• GOWORK=off go test ./...
• GOWORK=off go vet ./...

Refs GoCodeAlone/workflow#779

[Copilot]

Pull request overview

Adds AWS ownership tagging to the plugin by implementing the IaCProviderOwnership contract via the Resource Groups Tagging API. The provider tags ARN-backed resources with the workflow-owner key and exposes GetOwner/SetOwner/ListOwners through the gRPC IaC server. The workflow dependency and minEngineVersion are bumped to 0.69.x for the new contract, and root/embedded plugin.json manifests are aligned (with a parity test).

Changes:

• New provider/ownership.go implements OwnershipProvider with ARN→ResourceRef mapping and a tagged-resource client interface; covered by provider/ownership_test.go with a fake client.
• internal/iacserver.go registers the ownership server and exposes GetOwner/SetOwner/ListOwners RPCs; manifests in both plugin.json files advertise IaCProviderOwnership (and embedded manifest now also includes the previously missing IaCProviderRegionLister), with mapper/host conformance tests updated for parity and version.
• Dependency bumps: workflow v0.69.7, aws-sdk-go-v2 v1.41.9, new service/resourcegroupstaggingapi v1.32.2, smithy-go v1.26.0; CHANGELOG.md updated.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
provider/ownership.go	New OwnershipProvider implementation with ARN parsing helpers
provider/ownership_test.go	Unit tests with a fake tagging client
provider/provider.go	Wires the resourcegroupstaggingapi client into the provider
internal/iacserver.go	Registers and serves the IaCProviderOwnership RPCs
internal/iacserver_test.go	Adds compile-time guard for ownership server
internal/iacserver_mapper_test.go	Updates manifest test to require new service + version
internal/host_conformance_test.go	New test ensuring root/embedded manifests match
plugin.json	Bumps minEngineVersion and advertises ownership service
cmd/workflow-plugin-aws/plugin.json	Same advertisement, plus adds RegionLister for parity
go.mod / go.sum	Dependency bumps (workflow, aws-sdk-go-v2, tagging API, smithy-go)
CHANGELOG.md	Documents the new ownership feature and version bump

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.