fix(aws): ambient enumerates subnets

[lex00]

A subnet holding nothing is the same shape of question as an unused security group, and #1278 left it unreachable.

describeResources and observeDependencies both resolve outward from what is declared, so a subnet is recorded only when something in it is recorded — and a subnet with nothing in it is exactly what "which of my subnets are empty" asks about.

Found by measurement

Snapshotting an estate with seven subnets recorded five, and the two it dropped were the two with nothing in them. The default VPC's subnets are the archetype the ENUMERABLE comment already names: nothing declares them, and the only one ever recorded was the one that happened to hold an instance.

AWS::EC2::VPC was already enumerable and behaved correctly, which is why this presented as a snapshot-wide blind spot and turned out to be one missing table entry.

Effect

Before: snapshot held subnet-default-c (the one an instance occupied) and missed subnet-default-a/-b.
After: all three are recorded, and chant answers "subnets with no network interfaces: 2 — AWS-created default VPC subnets" where it previously reported none.

The test fails without the entry; I checked by removing it.

When this lands

This alone does not make the empty-subnet question answerable. It makes the
subnets present in the snapshot; two things still suppress the count.

1. Ambient regional resources are deduped account-wide, so a region's copy is lost #1416 — ambient resources are deduped account-wide by
   physical id in replay.ts, so a regional resource seen in three regions
   replays as one. With this PR merged, chant records nine default subnets and
   reports three.
2. Default VPC, subnet and security-group ids are identical in every region lex00/floci#21 — the emulator names the default VPC vpc-default and its
   subnets subnet-default-a/b/c in every region. On real AWS those ids are
   globally unique and Ambient regional resources are deduped account-wide, so a region's copy is lost #1416 would not be observable. Against Floci it is.

Measured after this PR: chant reports "Total subnets in estate: 5 · Subnets with
NO network interfaces: 2 · All empty subnets are in region us-east-1" against an
account holding 13 subnets, 8 of them empty across three regions. The kind is now
recognised; the per-region identity is not.

Follow-ups once merged

• Ship a version. The aws-bench chant arm vendors a packed tarball
  (chant-source.sh local|published), so an unreleased build cannot be pinned on
  that repo's main.
• Bump the arm off its current 0.33.1 vendored build once a release exists.
• Expect the workspace fingerprint to change. That field exists precisely to
  mark this: a run whose dependencies were rebuilt is a different experiment even
  when the code and the prompt match. chant's published g-series numbers are
  against 0.33.1 and will not be comparable — the arm needs a re-run before its
  board figures are quoted alongside the new build.
• Do not re-score the negative question set until Ambient regional resources are deduped account-wide, so a region's copy is lost #1416 is resolved, or the
  published number will be one a known defect is suppressing. Tracked in
  The negative question set has results but no way to publish them chant-bench#27.