Add -ProjectTag to the AWS coverage script

[ale210]

Delivers the re-runnable check asked for by hackforla/incubator#197, under epic hackforla/incubator#206.

-ProjectTag audits the project tag over the eight resource types the tag standard names, and classifies each resource four ways:

• conforming — a value the standard recognises
• shared — deliberately belongs to no single project
• nonconforming — a value that is not in the standard
• missing — no project tag at all

nonconforming is the bucket that matters, not missing, so it is printed in full on every run. Tag-based access control fails closed: a resource carrying an unrecognised value looks correctly tagged in the console and is still denied.

Why a separate sweep rather than a second column on the existing one

	default run	-ProjectTag
Tag	managed-by	project
Scope	~30 resource types	the 8 the standard names
Question	does anything manage this?	which project owns this?
A gap means	a hygiene problem	an outage

Bolting a project dimension onto all ~30 collectors would report a project tag for KMS keys and route tables, inventing gaps the standard never asked for — and would have meant editing all 43 Add-Resource call sites in a script whose value is being trustworthy.

Verification

Run live against 035866691871. It independently reproduces the incubator#197 audit, including flagging four SSM parameters as nonconforming without being told to look for them — the civic-tech-index / civictechindex split now tracked as hackforla/incubator#217.

Status        Resources          Kind                   Total Conforming Nonconforming Missing
------        ---------          ----                   ----- ---------- ------------- -------
conforming           60          ecr-repository             8          8             0       0
shared                0          ecs-service               10         10             0       0
nonconforming         4          ecs-task-definition       10         10             0       0
missing              41          ssm-parameter             36         32             4       0
                                 cognito-user-pool          3          0             0       3
60 of 105 (57.1%)                log-group                 18          0             0      18
                                 s3-bucket                  5          0             0       5
                                 iam-role-*                15          0             0      15

The existing managed-by report is unaffected. Full sweep run on this branch and diffed against coverage-2026-09-06.csv: zero ARNs changed bucket, unmanaged still 19. The only row differences are real churn — rolling RDS snapshots, a cycled ENI and ECS task, and the security group rule deleted by hackforla/incubator#213.

Still read-only: the new collectors go through the same Invoke-AwsCli, which refuses any subcommand that is not describe-*, list-* or get-*.

One trap documented in the README

aws ssm list-tags-for-resource accepts a parameter name with its leading slash — but Git Bash rewrites any argument starting with / into a Windows path, so the same call there fails with InvalidResourceId, and a sweep discarding stderr reads that as an untagged parameter.

That is what produced the "0 of 37 SSM parameters carry a project tag" figure in incubator#197 and in the decision record. It was wrong — every parameter was tagged the whole time. This script is PowerShell and unaffected, but anyone spot-checking one of its results from Git Bash will hit it.