[badmintoncryer]

Summary

EventPattern on AWS::Events::Rule and AWS::Events::Archive is typed only as object-or-string, so nothing looks
inside it, and a malformed pattern fails at deployment with "Event pattern is not valid". This adds E9014 (Error,
engine origin), which walks the pattern (object or JSON string) and reports unknown matcher keys, malformed
numeric/anything-but/prefix/suffix/exists/wildcard operands, $or with sibling keys, empty arrays, and scalars where
an array or object is required.

The walk lives in template-model/src/event_pattern.rs and is shared by both engines: the CEL engine calls it
directly, and the Rego policy calls it through a new event_pattern_violations() builtin (documented in
CUSTOM_RULES.md), following the shape of #452. Values that are unknown until deployment (Ref, GetAtt, Sub, If,
overridable parameters) are never judged.

Related issue

Closes #467

Validation behavior changes

Evidence: the EventBridge event pattern documentation (links in the issue) and deployments to a real account, in which
each rejected shape rolled back the stack with "Event pattern is not valid. Reason: ..." and the accepted controls
deployed (details in the issue).

Rejected cases: resources/templates/bad/E9014_invalid_event_patterns.yaml (one resource per shape, ten findings,
including a JSON string pattern and an AWS::Events::Archive).

Accepted cases: resources/templates/good/E9014_valid_event_patterns.yaml (every documented matcher shape, $or
nested and at the top level, a JSON string pattern, a CommaDelimitedList parameter, Fn::Sub, Fn::If, Ref and
Fn::GetAtt operands, and an archive).

Tests: unit tests in event_pattern.rs; cel-engine/tests/conformance.rs; rego-engine/tests/integration.rs;
cfn-validate/tests/resource_rule_parity.rs (asserts identical findings and the exact message per resource). Snapshots
were regenerated; the only changed report keys are the two new templates, and no existing corpus template gains a
finding.

Checklist

• For validation behavior changes, expected behavior is supported by CloudFormation evidence and all three engine
  selectors agree.
• My code adheres to the CONTRIBUTING GUIDE and the repo code conventions and style in the
  code quality guide.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.