existing references to AWS types whose primary identifier is an ARN fail when given the friendly identifier #13476

Bug information

Steps to reproduce

1. Reference an existing AMI by its image ID:

   extension aws
   
   resource image 'AWS.EC2/Image@default' existing = {
     alias: 'base-image'
     properties: {
       ImageId: 'ami-0829b74b2a8c619b7'
     }
   }

2. Deploy the template.

Observed behavior

The deploy fails. The Deployment Engine reads the resource with POST .../AWS.EC2/Image/:get. UCP passes ImageId to Cloud Control GetResource, and Cloud Control rejects it:

ARN 'ami-0829b74b2a8c619b7' does not match expected format 'arn:aws:ec2:us-west-2::image/{/ImageId}'

The primary identifier of AWS::EC2::Image is Arn. ImageId is only listed in the schema's additionalIdentifiers, and Cloud Control looks resources up by the primary identifier only. The same read with arn:aws:ec2:us-west-2::image/ami-0829b74b2a8c619b7 succeeds.

This affects 162 of the 211 read-only AWS types (CloudFormation registry, us-west-2, October 26, 2026): their primary identifier is an ARN, and the schema also lists a friendlier identifier. Examples:

• AWS::Bedrock::FoundationModel (ModelId)
• AWS::BedrockAgentCore::Browser (BrowserId)
• AWS::BackupGateway::Gateway (GatewayId)
• AWS::Athena::Session (WorkGroup, SessionId)

Desired behavior

When a read has a complete set of one of the schema's additionalIdentifiers but not the primary identifier, UCP works out the primary identifier and reads with it:

1. When the schema or Cloud Control documents the ARN format, UCP builds the ARN from the additional identifier plus the partition, region and account from the request scope.
2. Otherwise UCP lists the type with Cloud Control ListResources and picks the one resource whose additional identifier matches. No match returns 404, and more than one match returns 409.

This applies to reads only. Creates and updates behave as before.

Workaround

Pass the ARN instead of the friendly identifier, for example Arn: 'arn:aws:ec2:<region>::image/<ami-id>'.