feat: add demo S3 bucket without project tag

[Clause828]

Summary

• Adds aws_s3_bucket.demo_bucket to opentofu/aws/cloudwatch_dashboard/main.tf with tags that intentionally omit project

Demo purpose

• The tofu-cloudwatch-dashboard stack has the require-project-tag label, which auto-attaches the require_project_tag PLAN policy (admin/policies/plan/require_project_tag.rego)
• Expected: the plan check on this PR should be denied by that policy, since demo_bucket has a tags block with no project key

Test plan

• tofu fmt — clean
• tofu validate — passes
• Confirm Spacelift denies the plan for the missing project tag

🤖 Generated with Claude Code

[Clause828]

This is kept here for Demo purposes on what a opened/failed PR looks like