AWS RDS: follow-up parity gaps (major version upgrades, cluster member versions) #1673

Follow-up to #1521. These came up while fixing that issue in #1653 and during its review. Each item is a separate fix, and anyone is welcome to pick one up.

Medium

• ModifyDBInstance / ModifyDBCluster don't model AllowMajorVersionUpgrade, and don't reject a major upgrade when the resource is on a custom parameter group from the old family and no new group is given. These two checks belong together; see the ModifyDBInstance reference.

Low

• ModifyDBCluster with a new engine version doesn't update the member instances' engine version or default instance parameter group. This was already the case before fix(aws-rds): version-derived default parameter groups, real DescribeEvents and event-subscription delivery #1653.
• ListTagsForResource on a deleted or unknown event subscription (es:) ARN returns the generic DBInstanceNotFound that every untaggable ARN gets. Check what real RDS returns (likely SubscriptionNotFound).

How to work on an item

1. Claim it. Comment here with the item you're picking up, so two people don't fix the same thing. Small PRs are easier to review, so take one item, or a few that share a root cause.

2. Find out what real AWS does. Read the AWS API reference for the operation, and if you can, check the real CLI or SDK. Match the real error code, HTTP status and message. Don't guess them. Put the doc link in your PR.

3. Branch from development. All PRs go to development, never main.

4. Put the fix in the right layer. cloudemu has three layers, and the same behaviour has to work from the Go library and from cloudemu serve:

• services/<service>/driver/driver.go holds the driver interface. Touch it only when you add a new operation or field.
• providers/aws/<service>/ is the in-memory backend, and this is where most fixes belong: validation, state changes, lifecycle and error codes. Use memstore.Store, idgen for IDs, cerrors for errors and config.FakeClock for anything time-based.
• server/aws/<service>/ is the wire handler. It only translates the AWS protocol (query/XML, JSON or REST) to provider calls and maps errors back to the AWS shape. Don't put business rules here, or the library and the server will drift apart.
• If you add new state, make sure it survives cloudemu serve --persist and snapshots. persist/completeness_test.go will tell you if you missed something.
• If you add or change operations, run go generate ./... so docs/coverage stays current, and commit the result.

See docs/architecture.md and docs/STRUCTURE.md for the layout and file naming.

5. Test it the way a user would.

• A provider test that fails before your fix and passes after it.
• A wire test that drives the handler with the real aws-sdk-go-v2 client, like the existing *_sdk_test.go files.
• Run cloudemu serve and try the change with the AWS CLI (aws --endpoint-url http://127.0.0.1:4566 ...), including the error cases.
• If Terraform has a resource for it, run apply, then plan (it should show no changes), then destroy.

6. Run the checks before you push. go build ./..., go vet and go test on the packages you touched (the full go test ./... if you can), and golangci-lint run --timeout=9m ./... with zero issues.

7. Open the PR. Say which item it fixes, what changed and why, and how you checked it (paste the CLI commands you ran). Add "Part of #1673" so we can tick the box here once it's merged. See CONTRIBUTING.md for setup and code style.