feat: add support for Workflow resource

Implements the Workflow CRD (full CRUD) for the MWAA Serverless controller.

- ARN primary key with GetWorkflow-based read path
- Tag sync via ListTagsForResource + Tag/UntagResource hooks (UpdateWorkflow
  has no inline Tags member), implemented in pkg/tags and wired through
  the workflow read/update hooks
- Cross-resource references: iam Role, s3 Bucket, kms Key, ec2 SecurityGroup
  and Subnet
- Print columns, synced predicate, EngineVersion handling, and exception /
  terminal error code mapping

Two fixes from live end-to-end testing against the MWAA Serverless API:
- delete targets the whole workflow, not just a single version
  (sdk_delete_post_build_request)
- read path preserves EngineVersion, TriggerMode, and LoggingConfiguration to
  stop phantom UpdateWorkflow churn (sdk_read_one_post_set_output /
  sdk_update_pre_build_request)

Builds on the bootstrap PR (adds the Workflow resource that the bootstrap
placed in ignore.resource_names).

Author: Nathan Clonts

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2026-07-13T18:36:33Z"
+  build_date: "2026-07-13T22:14:15Z"
   build_hash: 01fb153549af6a2df3747478105143e989ff4355
   go_version: go1.25.0
   version: v0.60.0-7-g01fb153
-api_directory_checksum: d3137e7b874e92eeec596f22d86192a74a244409
+api_directory_checksum: d19e7e87fa0e0641a62316f8f7cd1e3a3aade331
 api_version: v1alpha1
 aws_sdk_go_version: v1.42.0
 generator_config_info:
-  file_checksum: 7a5ea9c886c80beb718544ec22f6d5a38fc4aca3
+  file_checksum: 5c8ece5b2fbe722de8b77efaad314c7cba2b357c
   original_file_name: generator.yaml
 last_modification:
   reason: API generation

apis/v1alpha1/enums.go

@@ -1,5 +1,90 @@
 sdk_names:
   model_name: mwaa-serverless
 ignore:
-  resource_names:
-    - Workflow
+  field_paths:
+    - CreateWorkflowOutput.Warnings
+    - CreateWorkflowOutput.RevisionId
+    - CreateWorkflowOutput.IsLatestVersion
+    - UpdateWorkflowOutput.Warnings
+resources:
+  Workflow:
+    is_arn_primary_key: true
+    ignore_idempotency_token: true
+    exceptions:
+      errors:
+        404:
+          code: ResourceNotFoundException
+      terminal_codes:
+        - ValidationException
+        - ServiceQuotaExceededException
+    fields:
+      EngineVersion:
+        late_initialize: {}
+      Name:
+        is_immutable: true
+      EncryptionConfiguration:
+        is_immutable: true
+      ScheduleConfiguration:
+        is_read_only: true
+        from:
+          operation: GetWorkflow
+          path: ScheduleConfiguration
+      WorkflowDefinition:
+        is_read_only: true
+        from:
+          operation: GetWorkflow
+          path: WorkflowDefinition
+      ModifiedAt:
+        is_read_only: true
+        from:
+          operation: GetWorkflow
+          path: ModifiedAt
+      RoleArn:
+        references:
+          resource: Role
+          service_name: iam
+          path: Status.ACKResourceMetadata.ARN
+      DefinitionS3Location.Bucket:
+        references:
+          resource: Bucket
+          service_name: s3
+          path: Spec.Name
+      EncryptionConfiguration.KmsKeyId:
+        references:
+          resource: Key
+          service_name: kms
+          path: Status.ACKResourceMetadata.ARN
+      NetworkConfiguration.SecurityGroupIds:
+        references:
+          resource: SecurityGroup
+          service_name: ec2
+          path: Status.ID
+      NetworkConfiguration.SubnetIds:
+        references:
+          resource: Subnet
+          service_name: ec2
+          path: Status.SubnetID
+    hooks:
+      sdk_read_one_post_set_output:
+        template_path: hooks/workflow/sdk_read_one_post_set_output.go.tpl
+      sdk_update_pre_build_request:
+        template_path: hooks/workflow/sdk_update_pre_build_request.go.tpl
+      sdk_delete_post_build_request:
+        template_path: hooks/workflow/sdk_delete_post_build_request.go.tpl
+    synced:
+      when:
+        - path: Status.WorkflowStatus
+          in:
+            - READY
+    print:
+      add_age_column: true
+      add_synced_column: true
+      additional_columns:
+        - name: STATUS
+          json_path: .status.workflowStatus
+          type: string
+          index: 10
+        - name: VERSION
+          json_path: .status.workflowVersion
+          type: string
+          index: 20