feat(aws): storage.rds FULL engine tables — 676+251 version constants [stacked on #144]

[so0k]

Storage slice PR 3/N — storage.rds engine tables, IN FULL (v2.263.0)

Stacked on #144. Lands instance-engine.ts (5,197 lines) and cluster-engine.ts (2,372 lines) — the complete engine/version tables, no subsetting:

• 676 public static readonly members in instance-engine.ts and 251 in cluster-engine.ts — exact upstream counts, enforced as hard CI-style gates in the conversion workflow and re-verified by an adversarial pass that spot-checked first/last plus random constants per engine family (names, version strings, @deprecated markers).
• Zero TODO: omitted markers — nothing was dropped from either file.
• All upstream @deprecated version markers kept intact.

Deviations (8 comments, 2 root causes)

1. Lazy/memoized rotation-application getters: singleUserRotationApplication / multiUserRotationApplication are resolved via memoized getters instead of upstream's eager readonly fields — ../../encryption (SecretRotationApplication) transitively imports back into the storage/rds barrel, and eager resolution during module-graph loading throws. Callers can't tell the difference; regression-locked by new tests (resolved app IDs per engine family + identity/memoization assertions, load-order verified).
2. s3ImportRole/s3ExportRole typed iam.IRole (upstream uses the generated IRoleRef layer TerraConstructs doesn't have).

Tightening (closes PR 2's temporary widenings)

• OptionGroupProps.engine restored to IInstanceEngine (the jsii-breaking-if-released widening flagged in feat(aws): storage.rds foundations — engines, groups, DatabaseSecret, canned metrics [stacked on #142] #144 is resolved within the same stack).
• All IEngine stand-in literals in tests replaced with real rds.DatabaseInstanceEngine.* / rds.DatabaseClusterEngine.* exactly as upstream tests use them.
• semver@^7.6.0 added via .projenrc.ts as a bundled dep (jsii-correct; mirrors upstream aws-cdk-lib's own bundled semver) — used by cluster-engine's aurora version-family logic, same as upstream.

Tests

248 rds suite tests green (ported upstream instance-engine.test.ts + cluster-engine.test.ts incl. the parameterGroupFamily derivation matrices, + rotation-application regression tests). jsii compile clean.

Live integ

The rds.groups fixture now constructs its engines from the real tables (DatabaseInstanceEngine.postgres(VER_16), DatabaseClusterEngine.auroraPostgres(VER_16_4), DatabaseInstanceEngine.mariaDb(VER_10_6)) instead of stand-in literals — the live run therefore proves the parameterGroupFamily/majorEngineVersion derivations against the real AWS APIs (postgres16, aurora-postgresql16, 10.6). Receipts in thread.

[so0k]

Live apply/verify/destroy receipts — make rds.groups with REAL engine tables (aws-vault → tcons-vincent, us-east-1)

PASS 154.55s (longer than PR 2's 45s only because the fresh worktree re-downloaded the provider — no warm plugin cache):

TestRdsGroups 18:37:05 Apply complete! Resources: 13 added, 0 changed, 0 destroyed.
rds_groups_test.go:48: subnet group rdsgroupssubnetgroup407c2e69 spans 2 subnets
rds_groups_test.go:58: instance parameter group rdsgroupsinstanceparamsf87d52a5 has user log_connections   <-- family postgres16 from DatabaseInstanceEngine.postgres(VER_16)
rds_groups_test.go:75: cluster parameter group rdsgroupsclusterparamsf182cc30 has user log_connections     <-- family aurora-postgresql16 from DatabaseClusterEngine.auroraPostgres(VER_16_4)
rds_groups_test.go:90: option group rdsgroupsoptions76bc54f6 carries MARIADB_AUDIT_PLUGIN                  <-- majorEngineVersion 10.6 from DatabaseInstanceEngine.mariaDb(VER_10_6)
rds_groups_test.go:98: database secret ...rdsgroupsSecretFF3D1A44-EBeCVx holds dbadmin credentials
TestRdsGroups 18:37:31 Destroy complete! Resources: 13 destroyed.
--- PASS: TestRdsGroups (154.55s)

The fixture's engines are now the real storage.rds tables (stand-in literals removed), so this run live-proves the parameterGroupFamily / majorEngineVersion derivation logic — AWS accepted every derived family, and the drift oracle (tofu plan -detailed-exitcode == 0) confirms clean read-back.