Harden CloudWatch Logs subscription filter discovery

[GrahamCampbell]

Summary

• Treat missing log groups as empty during subscription-filter discovery.
• Surface unexpected CloudWatch Logs discovery failures instead of silently assuming no filters.
• Cover missing-log-group and access-denied behavior.

Tests

• npx mocha --config "test/mocha/unit.cjs" "test/unit/lib/plugins/aws/deploy/lib/check-for-changes.test.js"
• npm run lint
• git diff --check