fix(#856): the long tail of draw sites — SSM, RAM, Backup and Bedrock

[scttfrdmn]

Tier 7 of #856, and the last of the service families: the long tail — SSM Run Command, RAM, AWS
Backup and Bedrock batch inference. Four generators, four unrelated services, and the tier where the
two rules the earlier tiers balanced finally point in opposite directions.

Three of the four keep the exact rendering their crypto/rand version produced, because their pages
publish no pattern to follow (#671): an SSM CommandId (published as a fixed length of 36, which
the UUID shape already met), the identifier inside a RAM resourceShareArn, and AWS Backup's
BackupPlanId, VersionId and SelectionId. Bedrock's does not — see Provenance.

Backup brings back the ordinal test tier 6 had to do without: CreateBackupPlan is the only draw
site in the tree that mints twice in one request, and UpdateBackupPlan mints a third value that
has to differ from both. A mint ignoring its ordinal would report a plan as its own version.

After this tier, 2 draw sites remain on crypto/rand: randomHex, whose one caller is the
CloudFormation deployer, and IDMint's own seedless fallback, which goes when the deployer threads a
request ID through. That is tier 8, and it is what lets the fallback be deleted.

Provenance

A Bedrock batch-inference job ID changes shape, and the published model is why. jobArn is
published as arn:aws:bedrock:{region}:{account}:model-invocation-job/[a-z0-9]{12} and
jobIdentifier as that ARN or a bare [a-z0-9]{12} — an alphabet that excludes the hyphen and a
length fixed at twelve. The 36-character UUID substrate minted satisfied neither, so a consumer
validating the ARN it was handed was validating against a value AWS would never issue. #856's rule is
not to change the bytes a caller sees, but that rule protects a rendering the model permits; it
cannot protect one the model forbids. (GetModelInvocationJob's own sample request shows
BATCHJOB1234, which the pattern beside it would reject. The pattern is the model.)

An AWS Backup plan ARN's case is observed, not published. AWS's sample is
arn:aws:backup:us-east-1:123456789012:plan:8F81F553-3A74-4A3F-B93D-B3360DC80C50 — an uppercase
UUID where substrate renders lowercase. BackupPlanId publishes no pattern and no length, so this is
read off the example. It is recorded beside the existing backup-plan vs. plan segment gap
(#1181) rather than folded in here, because it is a rendering question and not one about where the
bytes come from.

Compatibility

A Bedrock batch-inference job ID is no longer a UUID. A test that pins the literal shape of a
jobArn — 36 characters, hyphens, [0-9a-f] — will see twelve characters of [a-z0-9] instead. A
test that round-trips the value substrate hands it, or matches it against the published pattern, is
unaffected and was previously failing the pattern. Nothing else in this PR changes a rendering.

Every identifier this tier moves is addressed by a later call, so a stream recorded before this
change and replayed after it will mint different values — as it would for any tier of #856. Recorded
streams are not portable across a tier; that is what the tiering is for.

Verification

make lint, make test (race), and make docs-reference-check docs-versions version-check discarded-unmarshal-check wire-bookkeeping-check with the ratchet reporting 330. Non-vacuity: with
generateBackupUUID alone reverted to a seedless mint, the tier's replay produces 14 differences
and 3 refused reads out of a 10-request stream — a selection is stored under its plan ID, so a
re-minted plan strands the selection as well.

Refs #856.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!