fix(iam): ignore tags_all on hcptf roles (PLAT-210)

ignore_changes on tags does not cover provider default_tags. The prod
speculative plan still wanted Environment on tags_all and would TagRole.

terraform/hcp_iam.tf

@@ -721,9 +721,9 @@ resource "aws_iam_role" "hcptf_apply" {
   }
 
   # Apply role cannot iam:TagRole on itself. Provider default_tags
-  # (Environment/Workspace) would otherwise 403 mid-apply.
+  # merge into tags_all, so ignoring tags alone still 403s mid-apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }
 
@@ -746,7 +746,7 @@ resource "aws_iam_role" "hcptf_plan" {
 
   # Same self-tag restriction as hcptf_apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }