SageMaker AI: error when Role does not have DescribeDomain to all Domains in account

## Problem

The IAM Role I have access to does not necessarily have DescribeDomain for all the SageMaker Domains in the AWS account.
Instead of skipping those Domains that are not accessible, the toolkit currently errors out with AccessDeniedException on the first Domain that the role cannot perform a Describe on.

`[error] Failed to fetch space apps: AccessDeniedException: User: {redacted-role-arn} is not authorized to perform: sagemaker:DescribeDomain on resource: {redacted-domain-arn} with an explicit deny in an identity-based policy
`

https://github.com/aws/aws-toolkit-vscode/blob/7442e21c51cfb7863c77fabad02a324bb9d062eb/packages/core/src/shared/clients/sagemaker.ts#L312-L319

## Steps to reproduce the issue

1. Setup a few Domains in SageMaker AI
2. Provide access to only one of the Domains
3. Try to access via toolkit

## Expected behavior

Silently discard or log as WARN for each AccessDeniedException when performing DescribeDomain and gracefully proceed to the next Domain.

## System details (run `AWS: About` and/or `Amazon Q: About`)

- OS: Windows_NT x64 10.0.26100
- Visual Studio Code extension host: 1.106.0
- AWS Toolkit: 3.84.0
- node: 22.20.0
- electron: 37.7.0

Read packages/core/src/shared/clients/sagemaker.ts around lines 312-319, where DescribeDomain failures surface while fetching space apps. Reproduce the access-denied case with a role that can describe only some domains, then verify inaccessible domains are skipped or logged as WARN and processing continues for accessible domains.

Written by the indexing model from the issue text.