fix(catalog/aws): a Redshift Serverless workgroup lives in its namespace on a diagram; endpoint subnets and endpoint authorizations are access, not placement

[avinashsana]

Summary

Three reference fields on the Redshift kinds become containment_exempt, so a diagram draws a Redshift Serverless workgroup inside the namespace it serves (reaching into its VPC by lines) and never draws a Redshift cluster inside a VPC it merely authorizes. The containment-decision registry moves exactly those three lines from contained to exempt; nothing else moves.

Context

• AwsRedshiftServerlessNamespace is a container kind. Its workgroup referenced the namespace and three subnets, both as placement -- two rooms that cannot nest, which the doctrine has no honest way to draw (the platform's resolver falls back to topological order and can land the workgroup in a single subnet). The spec already says which room is home: "a workgroup computes; the data it serves lives on the namespace it attaches to." The exemption on AwsRedshiftServerlessWorkgroupSpec.subnet_ids records it -- the same verdict the ECS service carries for its subnets while its cluster places it.
• AwsRedshiftServerlessWorkgroupEndpointAccess.subnet_ids are the consuming VPC's subnets: an access path into the workgroup.
• AwsRedshiftClusterEndpointAuthorization.vpc_ids admit another account's VPCs to the cluster; the cluster's own subnet_ids stay placement.

Changes

• catalog/aws/awsredshiftserverlessworkgroup/v1alpha1/spec.proto: containment_exempt on subnet_ids and on EndpointAccess.subnet_ids, each with its reason in the field comment; regenerated spec.pb.go.
• catalog/aws/awsredshiftcluster/v1alpha1/spec.proto: containment_exempt on EndpointAuthorization.vpc_ids; regenerated spec.pb.go.
• shared/cloudresourcekind/testdata/containment_decisions.txt: the three verdicts, regenerated with -update.
• _changelog/2026-09/…redshift-serverless-workgroup-lives-in-its-namespace…md.

Test plan

• go test ./shared/cloudresourcekind/... green; the golden diff is exactly the three lines.
• buf lint / buf format (via make protos) clean; Go stubs regenerated. The Java stub compile lane could not run on the authoring machine (no JDK); CI's lane covers it.
• After release and the platform's pin bump, a Redshift Serverless workgroup naming its namespace and subnets draws inside the namespace room.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the Planton Contributor License Agreement (CLA.md) and I hereby sign the CLA.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}