fix(terraform): drop the unencrypted-upload opt-out and reject collector + managed scan together

[tim-thacker-nullify]

Round-3 review fixes for #88 and #89, stacked on #89's head branch.

R3-1, R3-6: allow_unencrypted_upload is removed, not plumbed.

• An empty kms_key_arn also sets enable_kms_access = false, so the role gets no KMS statement.
• The destination bucket sets SSE-KMS default encryption (monorepo context/iac/s3.tf:45-51, dast/iac/s3.tf:41-47), so a headerless upload is still encrypted with Nullify's key and needs kms:GenerateDataKey on it.
• That key is Nullify's, reachable only through kms_key_arn, so the opt-out cannot be made to work.
• The precondition is now kms_key_arn != "" alone; variable description, README KMS section and upgrade notes match.

Other findings:

• R3-2: nullify-aws-integration's kms_key_arn description (v5 :111, v6 :100) now states the cross-account rule locals.tf:30-36 implements.
• R3-3, R3-4: fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88's bare-key-form sentence is folded into fix(terraform): require KMS for the collector and narrow the key/* grant to cross-account #89's KMS paragraph. fix(terraform): accept every KMS key form the collector accepts #82 and fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88 should both be closed. fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88 contributes only that sentence over the shared merge base (git diff 9ac0299 e7211577 -- aws-integration-setup/ = 2 insertions) and reverts fix(terraform): accept every KMS key form the collector accepts #82's only code change, which this branch never had. Merging fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88 anyway reproduces the duplicate: git merge-tree HEAD origin/fix/terraform-collector-kms-input-forms-r2 lands both paragraphs, at README.md:280 and :284.
• R3-7: the scan_mode = "both" rejection moves into modules/k8s-resources as a precondition on the managed-scan ClusterRole, with a test row and a README paragraph by the variable list.
• R3-8: the placeholder KMS ARN in multi-cluster-complete/terraform.tfvars.example is commented out and reshaped so the variable regex rejects it if pasted as-is.
• CI: validate rows for the four remaining modules/ dirs. terraform test on this base already covers all six at 1.8.5 and 1.10.5, and is the only job evaluating validation blocks and preconditions.
• R3-5 deliberately untouched: the partition derivation is inert. Every ARN input still pins arn:aws: (eks-managed-scan-access/variables.tf:6, :22, :26, :43, :77, both kms_key_arn regexes), so split(":", arn)[1] can only be aws.
• R3-9 reported only; fix(aws): narrow the CloudFormation KMS key/* grant to another account's keys #90 narrows the CloudFormation grant.

Removing a declared variable breaks a direct module caller that sets it; no shipped example or root does. Nothing run locally — no terraform, helm, kubectl or AWS calls.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tim-thacker-nullify]

Collapsed into #78 at fa505f0 after passing adversarial review; all of this PR's commits are now in #78.