aws-ec2: EC2 deploys to wrong subnet

### Describe the bug

Context:
We want to deploy a static api as cheap as possible. For this reason we chose a nginx on EC2 without a load balancer, instead we have a simple routing in Route53 pointing to the EC2 instance.

We want to deploy the ec2 instance with a public ip address in a specific subnet called "public". We however can only choose the subnet by specficing the subnet type like this

`self._subnets = ec2.SubnetSelection(
subnet_type=ec2.SubnetType.PUBLIC
)`

This results in our instance being in the wrong public subnet called "nat". This subnet had previously the aws-cdk:subnet-name = public.

The subnet "public" has the type "Public" and has the following tags:
aws-cdk:subnet-type | Public
aws-cdk:subnet-name | public

We also tried to filter them by hardcoding for debug purposes but this throws synth error
RuntimeError: To set 'associatePublicIpAddress: true' you must select Public subnets (vpcSubnets: { subnetType: SubnetType.PUBLIC }):

`self._subnets = ec2.SubnetSelection(
subnet_type=ec2.SubnetType.PUBLIC,
subnet_filters=[
ec2.SubnetFilter.by_ids(["subnet-1", "subnet-2", "subnet-3"])
]
)`

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

We want to deploy ec2 instances in this subnet "public"

### Current Behavior

Instances are deployed to another subnet with the type "Public"

### Reproduction Steps

This an excerpt from our cdk.context.json:
'"subnetGroups": [
{
"name": "public",
"type": "Public",
"subnets": [...]
},
{
"name": "elb",
"type": "Public",
"subnets": [...]
},
{
"name": "nat",
"type": "Public",
"subnets": [...]
}]`

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.1027.0

### AWS CDK CLI version

2.1027.0

### Node.js Version

v24.6.0

### OS

MacOs

### Language

Python

### Language Version

Python 3.12.11

### Other information

_No response_

Start with the EC2 SubnetSelection and SubnetType.PUBLIC entry points, then reproduce the selection using the subnetGroups shown in cdk.context.json and the subnet_filters example. Check how named subnets are chosen when several groups have type Public, and verify that the expected public subnet is selected without triggering the associatePublicIpAddress validation.

Written by the indexing model from the issue text.