feat(terraform_plan): `resource_filter` — a per-record scoping predicate on `attribute` and `count`

The single largest coverage win measured against public check libraries: a list of {attribute, type, value} clauses evaluated against
change.after before emission; a record failing any clause emits nothing, so the universal AND
quantifies over the in-scope subset. "Only postgres instances", "only internet-facing LBs" — the
per-resource scoping predicate is the most common reason a public check cannot be expressed in
Tirith today.

Five corrections are mandatory, all verified against the engine:

1. change.after is None is out of scope unconditionally — IsEmpty(None), NotEquals(None,x)
   and NotContainedIn(None,[...]) all pass, so otherwise every destroy is in scope for every
   negative clause.
2. The empty-scope branch must return outputs explicitly, or the severity-2 attribute miss also
   fires and fails the plan.
3. DEFAULT_ERROR_TOLERANCE is 0, so validation must error (not warn) unless
   error_tolerance ≥ 1.
4. Drop scope_path and a filtered-count existential from v1.
5. Depends on the R1 decision "what does nothing-in-scope mean" and on the R1 skip-ordering fix.

Design question to settle before specification: many public checks bind two or three attributes
of the same array element (e.g. Kubernetes rules that must name both a resource and a verb;
name/value blocks where the name selects and the value is asserted). That is the same primitive
seen from inside a collection. Specified only as cross-resource scoping, resource_filter leaves
this on the table; specified as "bind several attributes of one collection member", it absorbs
both families at once — and it is exactly the same-element binding the documented at-least-one
idiom cannot do.

Start at the terraform_plan engine and the proposed resource_filter evaluation around change.after, then resolve the R1 "nothing-in-scope" and skip-ordering dependencies. Confirm the design covers the same-element binding question before specifying the feature. Done means the five mandatory corrections are represented, including explicit empty-scope handling and validation errors when error_tolerance is below 1.