feat(recommendations): carry AWS AvailabilityZoneId for any cross-account zonal EC2 purchase flow #812

Follow-up from platform#792 (D3 in plan platform-792-az.md, deferred).

AWS availability zone NAMES (e.g. us-east-1a) are mapped to physical zones per account, so the same name can be a different physical zone in two accounts. Today this cannot bite: recommendations are collected per account (AccountScopeLinked), tagged with that account's ID, and bought with that account's credentials, and #807 refuses zonal recs whose rec.Account is not the collecting account (payer-account case). If a flow ever buys zonal EC2 RIs across accounts (org-level recs, a payer buying for members, shared recs), the AZ name is not a safe identity: use the zone ID (use1-az1, via DescribeAvailabilityZones) instead.

Scope: decide whether a cross-account zonal flow is planned; if so carry AvailabilityZoneId alongside the name through collection, the recommendations key, the purchase guard and the idempotency key. If not, record the decision and close.