feat(cli): show reason and property diff when a resource is replaced

[naxty]

Summary

When formae apply plans a replacement (destroy + recreate) because a createOnly property changed, the plan preview now shows which immutable property(ies) triggered the replacement and their old→new values — rendered with the same diff tree used for in-place updates.

Before:

~ replace resource my-queue
    of type FakeAWS::SQS::Queue

After:

~ replace resource my-queue
    of type FakeAWS::SQS::Queue
    because these immutable properties changed:
      - FifoQueue: false → true

Approach

The triggering patch ops were previously computed and then discarded by filterCreateOnlyFields after needsReplacement was set. They're now preserved separately and plumbed through to the CLI:

• patch.GeneratePatch now returns the stripped createOnly ops as a second json.RawMessage.
• ResourceUpdate (internal) and apimodel.ResourceUpdate (API) gain ReplacementPatchDocument as operation-level metadata.
• The factory attaches it to the delete half of the replace pair; the renderer's group coalescer merges it onto the display update and adds an OperationReplace branch that calls the existing FormatPatchDocument.

Scope / Non-scope

• Scoped to plan-preview output (formatSimulatedResourceUpdate). Live apply progress (formatResourceUpdate) is unchanged — it's deliberately terse.
• Plugin boundary untouched. Plugins never see the new field; they still receive a plain delete + create.
• Core Resource model untouched. The field lives on ResourceUpdate, not on pkg/model/resource.go, because the replacement reason is operation metadata, not resource state. This keeps datastore resource persistence and secret-redaction paths untouched.
• The 6 existing replacement call sites in resource_update_generator.go (target-replace / dependency-driven replace) pass nil — they're not property-triggered, so there's no diff to show. The renderer's empty-check guard keeps their output identical to today.

Test Plan

• Unit: patch_document_test.go — TestGeneratePatch asserts the returned replacement ops contain exactly the createOnly paths
• Unit: resource_update_generator_patch_test.go — extended the existing VPC-CIDR replace test to assert the delete half carries ReplacementPatchDocument, create half and implicit-delete do not
• Unit: renderer_test.go — new TestRenderSimulation_Replacement_ShowsReason renders a replace and asserts the "because these immutable properties changed:" header + property name appear
• Existing TestFormatHumanReadableStatus_Replacement continues to pass (no replacement patch → bare header, as today)
• E2E: tests/e2e/go/replace_test.go (AWS path) — simulate before apply, assert ReplacementPatchDocument on the delete half references RoleName (the createOnly field in the fixture). Runs against real AWS; not executed locally.
• Full build + targeted test packages pass: patch, resource_update, resource_persister, metastructure, cli/renderer.

[JeroenSoeters]

Can't we use the existing PatchDocument field?