feat: unique change set names for diff, bootstrap and orphan

[mrgrain]

The fixed default change set names collide when two operations run concurrently against the same stack: the second operation deletes and recreates the change set under the same name, breaking the first. For change sets that are ephemeral anyway, a unique name per operation avoids this entirely.

This gives unique default names to the change sets that are always cleaned up or executed:

• cdk diff: cdk-diff-change-set-<uuid>, reusing the uuid the diff already generates for the change set's ClientToken. Diff change sets are always deleted in a finally, so nothing depends on finding them again by name. Anyone needing a deterministic name can use the --change-set-name flag from feat(cli): support --change-set-name for cdk diff #1982.
• cdk bootstrap: cdk-bootstrap-change-set-<uuid> — but only when executing. With --no-execute the change set is deliberately left in review for the user, so it keeps the stable default name: re-running bootstrap then replaces the pending change set instead of accumulating one per run.
• cdk orphan: cdk-orphan-step{1,2,3}-<uuid> with one uuid shared by all steps of an operation, so the change sets of one orphan run stay correlated.

The deploy default (cdk-deploy-change-set) is deliberately unchanged: the prepare-change-set → execute-change-set workflow relies on the stable name to find the change set again. Customers may use --change-set-name to provide a custom, unique name.

Because change set names are observable, a customer environments might have a condition IAM policy on them. All new names keep recognizable cdk-* prefixes, but any exact-match policy on the old names would no longer work. I think this acceptable, the names where never a documented stable contruct. Leftover uniquely-named change sets from crashed runs are purged by CloudFormation whenever any change set is executed on the stack, so they don't accumulate indefinitely.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.47%. Comparing base (59a01f8) to head (443c7e8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1985   +/-   ##
=======================================
  Coverage   91.47%   91.47%           
=======================================
  Files          80       80           
  Lines       12675    12675           
  Branches     1792     1792           
=======================================
  Hits        11595    11595           
  Misses       1042     1042           
  Partials       38       38           

Flag	Coverage Δ
suite.unit	91.47% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.