cfn: the aws:cloudformation:* stamp covers EC2 only, so the rest of a stack is unstamped

[scttfrdmn]

#746 made the CloudFormation deployer stamp aws:cloudformation:stack-name,
aws:cloudformation:stack-id and aws:cloudformation:logical-id on the resources it
creates, scoped to EC2. A stack's S3 bucket, DynamoDB table, Lambda function, SQS queue or
ELBv2 load balancer still carries no stamp, so a policy or a test conditioning on
aws:ResourceTag/aws:cloudformation:stack-name sees the EC2 resources of a stack and not the
rest of it.

EC2 was the first cut for a specific reason rather than convenience: ec2TaggableResource
resolves a physical ID to a state key by prefix, so all nine EC2 types the deployer creates
were covered by one call, and EC2 is what AWS's own
ManagedCloudformationResourcesCleanupPolicy conditions on. Every other service needs its
own resolver:

• S3 keys tags by bucket name in its own store.
• DynamoDB keeps them on the table record, under a member AWS does not publish.
• Lambda keys them by function ARN.
• SQS keys them by queue URL or name.
• ELBv2 has no tag store at all until elbv2: tagging, so elasticloadbalancing:CreateAction has a producer #748 lands.

So the work is one physical-ID → tag-store resolver per service, plus the decision of what to
do for a service that models no tags — skip silently, as EC2 does for an unresolvable ID, or
add the store.

StackDeployer.stampCFNResourceTags is the single call site and needs no restructuring: it
already runs for every deployed resource and returns early when the physical ID resolves to
nothing.

Acceptance criteria

• A stack's S3 bucket, DynamoDB table, Lambda function and SQS queue each carry the three
  aws:cloudformation:* tags, observable through that service's own tag-reading call.
• Each service's resolver is driven from the physical ID the deployer already holds, with
  no new bookkeeping on DeployedResource.
• A service substrate models no tags for is skipped silently rather than logged per
  resource, and the omission is named in docs/services.md.
• The condition keys those tags feed (aws:ResourceTag/…, and each service's own prefix
  where AWS publishes one) evaluate against them.

Carved out of #746 (v0.109.0).