An IaC drift detector ignores a tag-only difference, but the omitted tag controls an SCP exception and the next deploy fails in production only

The infrastructure looks equivalent in shape, yet one governance-relevant tag changed the allowed behavior.