emulator: substrate bookkeeping fields render as response members AWS does not publish

[scttfrdmn]

#738's audit of 158 json tag lines turned up a second, larger class it deliberately left alone:
roughly 96 lines render members AWS does not publish at all. They fall into two groups.

Substrate's own bookkeeping, on a type that reaches the wire. AccountID, Region and
CreatedAt appear on response structs across many plugins — WAFv2WebACL, WAFv2IPSet,
CloudTrailTrail and others — because the same struct is both the persisted record and the
response shape. AWS publishes none of them.

Fields that are substrate concepts. DynamoDB's TTLAttribute and Tags sit inside the
TableDescription that CreateTable and DescribeTable return; AWS keeps a table's tags behind
ListTagsOfResource and its TTL behind DescribeTimeToLive.

Why this was not folded into #738

Every AWS SDK drops members it does not know, so nothing decodes wrong and no consumer's code
breaks — the defect is cosmetic, visible only to a caller reading a raw response body or a
recorded event. #738's nine defects were the opposite: names an SDK reads and gets nothing for.
Mixing the two would have made a live-bug fix hostage to a large cosmetic sweep.

It is still worth doing. A consumer diffing substrate's raw response against a recorded AWS one
sees noise, and a member that is not in the API model is a place where substrate's shape and
AWS's can drift without a test noticing.

The shape of the work

The fix is not a tag deletion — the field is needed in state. It is a split between the persisted
record and the wire shape, either by a per-plugin render function (the renderImage /
fsxToWire pattern already in the tree) or by json:"-" plus a separate state encoding where
the field is not needed on read-back. Which one is right differs per plugin, so this needs an
inventory before an approach.

Acceptance criteria

• An inventory of every response-reaching field that is not in the AWS API model, with the
  plugin and the operation that exposes it.
• An approach chosen per plugin (render function vs. split encoding) with the reason recorded.
• No member absent from the API model reaches a response body, or the exception is named in
  docs/services.md with its reason.
• A test that fails if a new bookkeeping field is added to a wire-reaching struct.

Filed out of #738, which fixed the nine wrong names and named this class as out of scope.