Fail on stacks that use template transforms

[deorus]

Currently, updating a stack with a non-empty Transform section is a silent no-op: the params-only UpdateStack returns No updates are to be performed., which main() swallows as a ::warning::nothing to update and exits 0. The README already documents this as a known limitation, but there's no guard — the action reports success while changing nothing.

This adds a preflight check: GetTemplate (original stage) + hasTransform() parses the body for a top-level Transform section and fails with a clear error before calling UpdateStack.

YAML short-form intrinsics (!Ref, etc.) make full parsing impractical, so the YAML path only scans for a top-level Transform key; JSON templates are parsed properly.

Note: needs cloudformation:GetTemplate on the role (added to README permissions). There's no way to inspect the template without a Get* call — GetTemplate reuses raw-body parsing rather than the separate GetTemplateSummary action.

[doistbot]

This PR adds a preflight GetTemplate + hasTransform() check so that stacks with a non-empty Transform section fail with a clear error instead of silently no-opping during updates.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (3)

• [P3] main.go:245: This strict prefix check will miss the top-level Transform key if it happens to be quoted in YAML (e.g., "Transform": AWS::... or 'Transform':). Consider adding checks for "Transform": and 'Transform': to make the YAML fallback detection more robust.
• [P3] main.go:71: GetTemplate now runs before we validate toReplace against stack.Parameters, so a typo like MissingParam=value pays for a full template fetch even though DescribeStacks already gives enough data to fail fast. Move the transform check until after the len(toReplace) != 0 guard (or after building params) so unknown-parameter runs avoid the extra network round trip and template download.
• [P3] main_test.go:44: The JSON branch of hasTransform explicitly handles "[]" and "\"\"" (empty array and empty string) as no-transform cases, but there are no table entries covering them. A null Transform is tested; adding {"Transform": []} and {"Transform": ""} entries would lock in the behavior and guard against an accidental regression where a valid stack gets incorrectly rejected.

_{Share Feedback • Review Logs}