fix(terraform): compare full cluster ARNs in the collector duplicate guard and root-derive it correctly

[tim-thacker-nullify]

Round-5 review of #92 found the moved duplicate guard compared bare cluster
names (colliding same-named clusters in different regions/accounts, no
override in the v6 root) and derived its input from a list that means IRSA
trust, not collector deployment.

• Compare full cluster ARNs instead of names in eks-managed-scan-access
  (both trees); account/region/name are already parsed off the same ARN on
  both sides. Added a same-name-different-region test row in both trees.
• Added a root collector_cluster_arns override variable (both trees,
  default null) so a customer can correct the eks_cluster_arns-derived
  guess when trust is granted ahead of a staged rollout, or when cutting a
  cluster to managed scan without revoking IRSA trust in the same apply.
• Reworded the guard's error message to also name the Helm chart and
  manifest paths its own variable description already covers.
• Added ARN-shape validation to collector_cluster_arns, matching
  cluster_arns; it previously indexed split(...)[1] unguarded.
• Removed the dead collector_cluster_arns wiring in both multi-cluster
  examples: scan_mode's validation makes local.collector and
  local.managed mutually exclusive, so the expression was provably
  always []. Restructuring the example to exercise mixed modes per
  cluster is a larger change; scoped out.
• Fixed terraform-v6/README.md:117, which still documented the
  enable_collector + enable_managed_scan_rbac rejection this PR's base
  commit removed. Added the missing collector_cluster_arns docs and the
  Kubernetes-provider-removal upgrade note, matching the v5 tree.

Not fixed, by design: a direct caller of eks-managed-scan-access
(bypassing the root) still gets no protection unless it passes
collector_cluster_arns itself -- the module cannot discover a sibling
k8s-resources instance, so no non-empty default is expressible there. The
root's own derivation is the one automatic path, and it's now correct by
default.

Round-5's F10 (round-4's PR undercounted validate rows removed, four vs
six) is a note about that already-merged PR body; nothing here to correct.

Merge order: main ← #78 ← #81 ← #83 ← #89 ← #91 ← #92 ← this PR. #82 and
#88 (off #78) should be closed: #88 merges clean but leaves two duplicate
README paragraphs; #82 conflicts outright in k8s-resources/variables.tf
(both trees).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tim-thacker-nullify]

Collapsed into #78 at fa505f0 after passing adversarial review; all of this PR's commits are now in #78.