Integration test: ephemeral resources end-to-end, gated on Terraform >= 1.10

[so0k]

Follow-up from #296 (RFC-04 testing plan: "a typescript/synth-app-style integration test using ephemeral random_password, gated on a CI Terraform >= 1.10").

Why

#296's ephemeral-resource support is covered by generator snapshots and core synth unit tests, but no end-to-end integration test exercises cdktn get (schema fetch with a modern CLI) → generated EphemeralRandomPassword → synth/plan. The repo pins Terraform 1.7.5 via mise, which structurally cannot emit ephemeral_resource_schemas — so the test must be gated on a newer binary.

How (implementation notes)

• New integration target under test/typescript/ using hashicorp/random >= 3.7.0, targetVersions: { terraform: ">=1.10.0" } in cdktf.json, an ephemeral random_password, and a plan assertion.
• Gate: skip unless the available Terraform binary is >= 1.10 (runtime version probe), and/or add a CI matrix entry with a newer Terraform for this test only (the examples matrix currently runs tf 1.6.5).
• Also exercises the feat: support newer provider plugin-protocol features via targetVersions (RFC-04) #296 fetch-time warning path negatively: with a >=1.10 binary and admitting targets there should be no emission-gap warning.