Create a safe recovery image before maintenance

A production reporting instance needs an operating-system update, but the last maintenance window had to be rolled back. The current Systems Manager runbook creates an image by rebooting the instance, tags the source instance instead of the new image, and gives every backup the same name. Operations needs a usable recovery image without interrupting current traffic.

Repair maintenance-backup.yaml to create one uniquely named pre-maintenance image from InstanceId without rebooting.

• Tag that image with BackupFor = InstanceId and ManagedBy = SystemsManager, and return its ImageId.
• Preserve the supplied parameters and role binding; keep only image creation followed by tagging, with either failure aborting safely.