fix(ci): the AppSync resolver-order guard depends on a hand-maintained target list #846

What is wrong

scripts/appsync-ensure-resolver-order.sh takes its -target addresses from hand-written lists in .github/workflows/deploy-shared.yml and scripts/ephemeral-env.sh. When a change deletes an aws_appsync_function or aws_appsync_datasource, the configuration edge that ordered its destroy after the referencing updates is deleted too, so OpenTofu walks the destroy nodes first and AWS refuses with Data source is still in use by functions / Data source is still in use by resolvers.

The guard fires in that situation but only applies the objects someone remembered to list. Every occurrence of this outage — the #298–#301 Lambda-to-JS migrations, then #750, which froze Deploy Production for 13 consecutive runs until #845 appended three more addresses — was "the list was not updated". The parity test that keeps the two lists in sync only keeps them wrong consistently.

Desired behaviour

Derive the targets from the deploy plan instead of a human-maintained list: plan, collect every planned aws_appsync_function / aws_appsync_datasource deletion address from the plan JSON, apply everything else with tofu apply -exclude=<addr> (OpenTofu >= 1.9), and let the normal apply perform the deletes. No-op when the plan contains no such deletions; any guard failure still aborts before the main apply.

Related: the emergency instance fix was #845.