fix(apply): merge live plugin hints into forma schema before patch generation

[JeroenSoeters]

Summary

• The apply/simulate path generated patches against whatever Schema.Hints the CLI baked into the forma at PKL eval time. Those hints come from the formae SDK version the client's PklProject pins, which may lag behind the SDK bundled with the running agent. Newly-added Hint paths on the agent side (e.g. a hasProviderDefault on a deep sub-resource field, such as the one added in fix(pkl-schema): emit hints for fields under SubResources without a FieldHint #428 for Volumes.EFSVolumeConfiguration.RootDirectory) were absent from the CLI-supplied schema, so the recursive provider-default stripper had nothing to walk. Stored state carrying an AWS-populated default stayed untouched and a createOnly ancestor tripped a full replacement on every reapply.
• Previously, only the Synchronizer refreshed schemas before patch generation. Sync-driven refreshes only write a row when OOB drift is detected, so any resource whose cloud-side read equals its stored state never had its schema refreshed — stored Schema.Hints stayed frozen at the SDK version in play when the resource was created.
• Fetch the live per-resource-type Schema from the PluginCoordinator in ApplyForma, then merge its Hints into each forma resource before GenerateResourceUpdates runs. Hints are merged, not wholesale-replaced: live hints override on key collision; CLI-supplied hints the live schema doesn't know about are preserved. Fields, Identifier, Portable, and the rest of the Schema are deliberately untouched — those reflect the resource instance's property shape (e.g. classifying properties as regular vs read-only) and must stay in the form the CLI produced.
• New reconcile test in resource_update_generator_reconcile_test.go mirrors the ECS AWS::ECS::TaskDefinition.Volumes.EFSVolumeConfiguration.RootDirectory shape: a CLI-supplied Schema missing the deep hasProviderDefault hint, a stored resource carrying the AWS-populated default, and a live plugin schema that has the hint. With the merge in place the stripper neutralizes the default symmetrically and no replacement is emitted.
• Callers that don't have (or don't need) agent-side refresh — Synchronizer (already stamps fresh schemas inline upstream), Discovery, AutoReconciler, StackExpirer — pass nil for the new parameter. ApplyForma and DestroyForma thread the fetched schemas through FormaCommandFromForma.