feat(cmd): collect RDS live and unlock the storage-parity seam

[agenticode]

--rds-region REGION drives the same pkg/rds collector through pkg/provider's
SDK adapters. --rds-fixture is untouched and remains a sibling;
TestTheLiveRDSCollectorIsReachableFromTheBinary asserts both sources produce a
byte-identical report over the same account.

--rds-parity fills rds.Config.Parity from DescribeValidDBInstanceModifications
and DescribeEvents, on both sources. Without it four fixture instances refuse
with no-storage-performance-model; with it that code is gone and 4
no-io-measurement, 2 provisioning-envelope-unknown and 1 gp2-band-unpublished
take its place. The cmd-side holder returns a suppression, never ok=false, which
would emit neither proposal nor refusal.

Degraded is not broken: one retry gated on IsAccessDenied and a get-metric-data
error, so a throttle stays fatal and a denied DescribeDBInstances stays fatal.
An unreadable tag is not an absent tag — a denied ListTagsForResource warns
naming the ARN and the key, and the guardrail refusal disappears rather than
collapsing into 'looked and found none'. buildRuntime returns nil on error, so
rdsFailure folds warnings recorded before a hard failure into the error.

No actuator becomes reachable: TestNoActuatorBecomesReachableThroughTheLivePath
asserts a live parity-enabled domain still yields actuatable=false, 0 steps,
RefuseReportOnly. 19 test functions, zero credentials or sockets. go.mod and
go.sum unchanged.