cfn: CreateStack's Tags.member.N is dropped, and nothing propagates a stack tag to its resources

[scttfrdmn]

CreateStack accepts Tags.member.N, and substrate drops them. CFNStackState has no
Tags field at all, so the tags are not recorded on the stack, not reported by
DescribeStacks, and not propagated to the resources the stack creates.

Both halves are missing and both are observable:

• The stack's own tags. AWS's CreateStack documents up to 50 Tag members, and
  DescribeStacks reports them back. A caller who tags a stack and reads it back gets an
  empty list here.
• Propagation. AWS propagates a stack's tags to the resources it creates, for the
  resource types that support tagging, so a policy or a cost report keyed on a stack tag
  reaches the resources. Nothing propagates here.

#746 delivered the other mechanism — CloudFormation's own
aws:cloudformation:stack-name/stack-id/logical-id stamp, which is CFN's bookkeeping and
not caller-supplied. That is why this is a separate issue rather than the rest of #746: the
stamp needed no new state, and this needs a Tags field on the stack record, a
DescribeStacks member, and a decision about what happens to a propagated tag when the
caller later removes it from the stack.

The seam #746 built is reusable: StackDeployer.stampCFNResourceTags is called from the one
place that holds the physical ID and the stack context, so propagation is more tags through
the same call — but only for the resource types that path can resolve (EC2 today, see the
sibling issue on widening it).

Acceptance criteria

• CreateStack's Tags.member.N is recorded on the stack and reported by
  DescribeStacks, with AWS's documented limits and key/value patterns.
• UpdateStack can add, change and remove a stack tag, and the removal reaches the
  resources the tag was propagated to.
• A stack tag is propagated to the created resources that support tagging, and a
  caller-supplied tag whose key begins with aws: is refused as AWS refuses it.
• A resource tag the caller set directly is not clobbered by propagation.
• docs/services.md records what propagates, what does not, and why.

Carved out of #746 (v0.109.0).