statelessStampGaps' plan-time unstamped error has no node-path equivalent (left behind by the stamp retirement, #644)

[lex00]

What

#644's stamp retirement (PR #944) deleted the HCL stamp. Its close-out names two behaviours the deleted stamp carried that the node path does not, both already inert on the default path since the 2026-08-25 CHOUDOUFU_NODE_RESOLVE flip. This is the second: statelessStampGaps' plan-time error for a marker-only resource the stamp could not reach. live-check still reports the same sites offline (55 at 22d9a3f, Unmarked apply of a marker-only resource), so the refusal exists as a check but no longer fires at plan time.

Do

1. Decide whether the plan-time refusal is still wanted now that identity resolves at the plan node. If the node path can always stamp what the static evaluator could not, the offline check is the whole story and this closes with that ruling written down.
2. If a plan can still reach apply with an unstamped marker-only resource, add the refusal on the node path and prove it red with a fixture that today plans a create with no marker.
3. Either way, live/LIMITATIONS.md's entry for this refusal must say where it fires (cleanup: render LIMITATIONS.md from check.AllRefusals() instead of hand-maintaining it #698's generated span covers the registry entry; the framing prose is hand-written).

Refs #644, #944, #698.

[lex00]

Answered with evidence, PR #1006: yes, a plan can still reach apply with an unstamped marker-only resource.

projection.NodeResolver.AdjustConfigValue returns a needs-discovery instance's configuration unchanged with zero diagnostics when its type's schema has no tags surface (markers.TagSurface false) — no warning, no error. Nothing on the live plan/apply path ever consulted internal/live/check's NodeStampUnmarkedApply (the only thing that has ever said so, and only through the separate live-check subcommand), and lint's markerless-type veto only catches types the hand-curated markerless_generated.go table already knows about — a real schema surprise for a type not on that list sails straight through to apply.

Reproduced with a fixture (aws_vpc, real ClassNeedsDiscovery type, schema stripped of tags) reverted against the fix: choudoufu plan -estate=... exits 0 and proposes a silent create.

Route 2: the refusal is added on the node path, reusing check.NodeStampUnmarkedApply (now exported) from both live_plan.go and live_mode.go, with a #364 record-backed exemption threaded through and covered by its own test. live/LIMITATIONS.md updated to say where it fires now.

PR: #1006