fix(discovery): drop SecretTargetAttachment discovery and the $LATEST version pseudo-entry

[JeroenSoeters]

Summary

• Restore discoverable = false on AWS::SecretsManager::SecretTargetAttachment, with the reason recorded inline. CloudControl's list handler returns every secret in the account rather than actual attachments: the type is an action performed on a secret, not a cloud object with an inventory, so there is nothing to enumerate and reads of the listed ids fail. In any account holding secrets this failed a discovery sync command on every cycle. A custom list is not a viable alternative: the only signal that a secret carries an attachment lives inside the secret's value, which discovery must not read. The type remains fully declarable and manageable.
• Exclude the $LATEST pseudo-version from AWS::Lambda::Version discovery at list time (same mechanism as the AWS-managed policy and reserved alias exclusions). CloudControl's version list includes $LATEST, but it is not a published version and reading it always fails; this was previously masked by the list post-filter dropping ARN-form results and surfaced once that was fixed. Published versions keep discovering.

Verification

• Unit tests cover both exclusion behaviors; make build, make verify-schema, make test-unit, make lint all pass.
• Both failure modes were reproduced against a live account (the attachment list returning plain secret ARNs; version reads failing only for $LATEST-suffixed ids). Targeted conformance for lambda-version and lambda-version-ref dispatched from this branch; results will be linked in a comment. The attachment type has no conformance fixture; its discovery test returns to skipping, as before the flag flip.