core: CDK breaks when CFN template is updated outside of CDK

### Describe the bug

This one was a surprise and only came about because of a mistake. This issue has been replicated with CDK 2.1138.0 (build a4c0282).

An existing CFN stack (created by CDK) with a resource with a `DeletionPolicy` can be updated outside of CDK in a way that breaks all future CDK runs against that stack, while being perfectly acceptable to CloudFormation.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

CDK should not break on existing templates that CloudFormation is quite happy with

### Current Behavior

A manual update to a stack can cause CDK to fail in unexpected ways; diagnosing the problem via the console or AWS CLI does NOT reveal the problem.

### Reproduction Steps

1. Start with an existing CDK app created without modification using the CDK "getting started" example (`mkdir hello-world && cd hello-world && cdk init sample-app --language=typescript`) and deployed
2. Copy the JSON template (either from the CloudFormation console, or from `aws cloudformation get-template ...`) and, in the resource definition for the `AWS::SQS::Queue`, make the following change:

FROM
```json
"CdkShouldFailQueueF196B131": {
"Type": "AWS::SQS::Queue",
"Properties": {
"VisibilityTimeout": 300
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"aws:cdk:path": "CdkShouldFailStack/CdkShouldFailQueue/Resource"
}
},
```

TO
```json
"CdkShouldFailQueueF196B131": {
"Type": "AWS::SQS::Queue",
"Properties": {
"VisibilityTimeout": 300
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "RetainExceptOnCreate",
"Metadata": {
"aws:cdk:path": "CdkShouldFailStack/CdkShouldFailQueue/Resource"
}
},
```

A second `UpdateReplacePolicy` and `DeletionPolicy` key has been added.
3. Update the stack in place (either via changeset or directly), using the console or command line but NOT using CDK
4. Now do `cdk diff` and see the failure `Map keys must be unique; "UpdateReplacePolicy" is repeated`

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.266.0

### AWS CDK CLI version

2.1138.0 (build a4c0282)

### Node.js Version

Node.js v22.22.2

### OS

Linux (Fedora 43)

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Reproduce the issue with the TypeScript getting-started app, an AWS CloudFormation template fetched with `aws cloudformation get-template`, and `cdk diff`. Start at the `cdk diff` entry point and its handling of the deployed template; done means a CloudFormation-accepted template with repeated policy keys no longer causes CDK to fail with the duplicate-key error.

Written by the indexing model from the issue text.