Add reversible External ID and safe GovCloud workflows

[captainpacket]

What changed

• adds the reversible external-id migration command for existing AWS setups
• adds GovCloud-aware Organizations discovery and preserves arn:aws-us-gov role partitions
• adds onboard-accounts and sync-accounts for reviewed standalone-account manifests
• adds collector instance-profile payload support for self-managed GovCloud collectors
• adds a GovCloud operator workflow covering normal Forward/NQE discovery and the manual fallback
• hardens preflight and apply paths against unsafe GovCloud removals and partition mismatches

Why

Forward's regular AWS collector can discover a GovCloud Organization, but federal customers may not grant Organizations access or may operate standalone accounts. The previous CLI also generated commercial-partition IAM ARNs when adding accounts and allowed a reviewed payload to bypass source-specific removal checks.

Safety behavior

• dry run is the default
• mixed or region-mismatched AWS partitions fail planning/preflight
• NQE-driven GovCloud removals require positive Organizations evidence
• authoritative manifest removals require explicit --allow-removals
• apply-plan reloads current state and cannot bypass GovCloud removal controls
• account manifests require unique 12-digit IDs
• instance-profile payloads contain no static credentials

Validation

• make ci
• go test -race ./...
• 75 tests across 6 packages
• git diff --check
• CLI help smoke tests for both manifest commands
• prior live round trip for External ID: null -> value -> null with cleanup