feat(provx): mark connect artifacts formae-owned

[JeroenSoeters]

Summary

The role and OIDC provider connect creates in a customer account are discovered like any other resource and land unmanaged, where nothing stops someone importing them and reconciling them away. Doing that to the provider severs formae's own access to the account.

Write a single marker, formae-owned=true, that the cloud plugins' discovery filters key on. It answers one question, whether formae created the thing, and deliberately not who may delete it: that stays with the formae-ai:owner / formae-ai:subject provenance tags whose values the delete gate reads.

The key avoids a colon so the same spelling is legal on all three clouds. GCP label keys admit only lowercase letters, digits, underscores and hyphens, which is also why azure moves from formae:owned to the shared key.

Tagging is best-effort, and the provider is tagged through its own request rather than the create's Tags field. CreateOpenIDConnectProvider has never needed iam:TagOpenIDConnectProvider, so requiring it there would break connect for callers it works for today; degrading to an untagged provider leaves them exactly where they already are. The role has no such exposure, since AWS already requires iam:TagRole to pass Tags to CreateRole, but it is treated the same way for consistency.

Both markers are also written on the converge path. That is what carries them to the roles and providers already standing in accounts connected before this existed, so re-running connect is the migration rather than a one-off script.

Azure needs no convergence work: CreateOrUpdate on the resource group and identity is already an upsert carrying Tags.