fix(core): ensure CloudFormation ChangeSets receive tags with explicitStackTags flag

[AkitoAndo]

Issue # (if applicable)

Closes #35137.

Reason for this change

A regression was introduced in v2.205.0 where CloudFormation ChangeSets stopped receiving tags when
the @aws-cdk/core:explicitStackTags feature flag is enabled. This breaks deployments in
environments with SCP (Service Control Policy) policies that require specific tags to be present on
ChangeSets for compliance and governance purposes.

Description of changes

Root Cause:
The explicitStackTags feature flag automatically adds aws:cdk:stack to the excludeResourceTypes
array when using Tags.of(stack).add(), which prevents tags from being applied to the stack itself.
While this correctly prevents duplicate tagging of resources, it also prevents ChangeSets from
receiving the necessary tags.

Solution:

1. Added new applyToChangeSets property to TagProps interface (default: true)

   • Allows explicit control over whether tags should be applied to ChangeSets
   • Maintains backward compatibility by defaulting to true

2. Enhanced Tags.of(stack).add() method to handle ChangeSet tagging

   • When explicitStackTags is enabled and applyToChangeSets is true (default), tags are
     applied directly to the stack using addStackTag()
   • This ensures ChangeSets receive the required tags while still preventing resource duplication
   • Users can set applyToChangeSets: false to disable this behavior if needed

3. Added comprehensive unit tests to verify the fix works correctly in all scenarios

Design Decisions:

• Opt-out approach: applyToChangeSets defaults to true to maintain existing behavior and fix
  the regression automatically
• Minimal API surface: Only one new optional property added to existing interface
• Backward compatibility: Existing code continues to work without changes
• Explicit control: Advanced users can disable ChangeSet tagging if needed

Alternatives considered and rejected:

• Modifying the feature flag behavior: Would break the intended separation of stack vs resource
  tags
• Automatic detection of SCP policies: Too complex and environment-dependent
• Always including aws:cdk:stack in includeResourceTypes: Would re-introduce the duplicate
  tagging problem

Describe any new or updated permissions being added

No new IAM permissions are required. This change only affects how existing tags are applied to
CloudFormation ChangeSets.

Description of how you validated changes

Unit Tests Added:

• Verified tags are applied to ChangeSets when explicitStackTags is enabled
• Tested applyToChangeSets: false explicitly disables ChangeSet tagging
• Confirmed legacy behavior is maintained when explicitStackTags is disabled
• Verified direct stack tagging with addStackTag() continues to work
• Tested mixed tagging approaches work together correctly
• Added test for token handling in tags with appropriate warnings

Manual Testing:

• Tested with CDK apps using the explicitStackTags feature flag
• Verified ChangeSets receive proper tags in the CloudFormation console
• Confirmed resources don't receive duplicate tags from both template and stack propagation

Checklist

• My code adheres to the CONTRIBUTING
  GUIDE and DESIGN
  GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the
Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.