docs: record aws tag projection move

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -232,6 +232,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `56471479f` | `spinifex/utils` (`ValidateKeyPairName`) | `spinifex/handlers/ec2/key` | EC2 key-pair-name validation has one production owner and is now private to it. Its moved unit matrix and full key-handler suite passed. |
 | `cf531cd73` | `spinifex/utils` (QMP telemetry filename convention) | `contracts/telemetry/v1` | The telemetry QMP prefix and metadata path are part of the existing VM-runtime-to-collector file contract. The contract test, focused VM telemetry tests, collector suite and caller compilations passed; the broader VM suite is sandbox-blocked by unrelated socket setup. |
 | `83615f1f4` | `spinifex/utils` (AWS XML response helpers) | `spinifex/foundation/aws/xml` | EC2 XML response normalization/enveloping and IAM-style Query envelopes are shared AWS protocol mechanics. Focused XML tests and all direct caller compilations passed; the RDS-agent package was compile-checked without execution because its FIPS bootstrap requires a FIPS-enabled runtime. |
+| `9896834b2` | `spinifex/utils` (`ExtractTags`, `MapToEC2Tags`) | `spinifex/foundation/aws/tags` | Generic EC2 tag-specification extraction and API-model projection join the AWS tag foundation; KV tag mirroring remains separate state-layer work. Focused tag tests and direct caller compilations passed; the volume package was compile-checked without execution because its test main opens a sandbox-blocked TCP listener. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS