AWS Resource Groups Tagging API: some discovery walkers still abort when a resource vanishes mid-walk #1667

Follow-up from the review of #1645. That PR made the shared project helper in providers/aws/rgt_discovery.go skip a resource whose tag read returns NotFound (the resource was deleted between the list call and the tag read), which fixed the 13 walkers that use it. Each item is a separate fix, and anyone is welcome to pick one up.

Medium

• The Glue, Kafka, Kinesis and GuardDuty walkers in providers/aws/rgt_discovery.go don't go through project. If one of their resources is deleted between list and tag read, the NotFound aborts the whole GetResources call for every service. Apply the same skip-on-NotFound there, and add a test like TestKeyspacesDiscoverySurvivesConcurrentDelete from fix(aws-keyspaces): tag existence and restrictions, name validation, missing-keyspace error, GetTable omissions #1645.

How to work on an item

1. Claim it. Comment here with the item you're picking up, so two people don't fix the same thing. Small PRs are easier to review, so take one item, or a few that share a root cause.

2. Find out what real AWS does. Read the AWS API reference for the operation, and if you can, check the real CLI or SDK. Match the real error code, HTTP status and message. Don't guess them. Put the doc link in your PR.

3. Branch from development. All PRs go to development, never main.

4. Put the fix in the right layer. cloudemu has three layers, and the same behaviour has to work from the Go library and from cloudemu serve:

• services/<service>/driver/driver.go holds the driver interface. Touch it only when you add a new operation or field.
• providers/aws/<service>/ is the in-memory backend, and this is where most fixes belong: validation, state changes, lifecycle and error codes. Use memstore.Store, idgen for IDs, cerrors for errors and config.FakeClock for anything time-based.
• server/aws/<service>/ is the wire handler. It only translates the AWS protocol (query/XML, JSON or REST) to provider calls and maps errors back to the AWS shape. Don't put business rules here, or the library and the server will drift apart.
• If you add new state, make sure it survives cloudemu serve --persist and snapshots. persist/completeness_test.go will tell you if you missed something.
• If you add or change operations, run go generate ./... so docs/coverage stays current, and commit the result.

See docs/architecture.md and docs/STRUCTURE.md for the layout and file naming.

5. Test it the way a user would.

• A provider test that fails before your fix and passes after it.
• A wire test that drives the handler with the real aws-sdk-go-v2 client, like the existing *_sdk_test.go files.
• Run cloudemu serve and try the change with the AWS CLI (aws --endpoint-url http://127.0.0.1:4566 ...), including the error cases.
• If Terraform has a resource for it, run apply, then plan (it should show no changes), then destroy.

6. Run the checks before you push. go build ./..., go vet and go test on the packages you touched (the full go test ./... if you can), and golangci-lint run --timeout=9m ./... with zero issues.

7. Open the PR. Say which item it fixes, what changed and why, and how you checked it (paste the CLI commands you ran). Add "Part of #1667" so we can tick the box here once it's merged. See CONTRIBUTING.md for setup and code style.