Add a control-plane replica option and read teardown by resource

Two fixes to the AWS OpenShift lane.

Compact cluster. --control-replicas 3 (or SIM_AWS_CONTROL_REPLICAS=3) builds three schedulable control-plane nodes; the default stays 1. The count is kept in the run state, the vCPU quota check adds 8 per extra node, every control-plane node is hardened, and the safety net terminates all of them.

Clean teardown exits 0. The final listing of down trusted the resource tagging index, which trails a deletion by minutes and kept naming deleted network interfaces and volumes. It now reads each tagged network interface, volume, snapshot, security group, subnet and VPC from EC2. Only a NotFound answer counts as gone; any other read failure stays a leftover, so a real leftover still fails.

Self-tests cover the replica count, its refusal, and the direct reads. just ci passes.

🤖 Generated with Claude Code