fix(aws): record the pending endpoint update id and count every EKS tag

[tim-thacker-nullify]

Round-4 review fixes for #79: R4-79-1, R4-79-2 and R4-79-3 on setup-eks-managed-scan.sh.

• R4-79-3 apply records the id update-cluster-config returns in a nullify-pending-update cluster tag, straight after the call. The in-progress guard describes that one update instead of trusting ListUpdates, whose consistency AWS does not document. The tag is dropped with the pending CIDR record.
• R4-79-1 Only a record written without an id falls back to describing every update ListUpdates returns, so the common path is one call, not one per historical update. A describe-update failing with ResourceNotFoundException is skipped with a warning; every other failure still dies.
• R4-79-2 The tag-slot precheck counts every tag key, aws: ones included, and reads them through the same keys(cluster.tags) query load_cidr_records uses. That drops the length(keys(...)[?!starts_with(@, 'aws:')]) expression no test executed, and the assumption that aws: tags are exempt from the 50-tag quota. The records now need three free slots.

Tests: four new bats cases (the id is recorded between the update and the wait; a recorded InProgress update stops apply without calling list-updates; a forgotten id does not; remove drops a stale id tag), plus one pinning that aws: tags count. The two tag-limit cases move from two free slots to three. The fake CLI now describes update-1, the id it hands out, so the recovery cases take the real path.

Still open from round 3: R3-74-3, the fallback RBAC manifest is still fetched from the mutable tag nullify-k8s-readonly-access-v0.1.0 with no commit pin and no RBAC_MANIFEST_SHA256, so a moved tag makes remove delete a different object set than apply created. The tag still does not exist; pinning needs it created, which needs PR #84.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tim-thacker-nullify]

Collapsed into #64 at f9903ac after passing adversarial review; all of this PR's commits are now in #64.