my pulumi state has deviated from reality and i’m not sure how to fix it. i have an ec2 instance that i created from a specific commit; it has instance termination protection enabled. a colleague of mine went to add some new ebs volumes to the same stack, and when he went to run pulumi up, it wanted to replace the ec2 instance, because it thought something had changed in its security group definition (i see no such changes in the code). since instance termination was enabled, pulumi failed to delete the original ec2 instance. it did create the replacement instance, but failed before it ever got to the new s3 volumes my colleague was trying to create. even if i check out the commit that i last successfully deployed the ec2 instance from, pulumi still insists there are some sg changes. how do i get back to a sane state, here?