feat: scaffold individual Registry resource modules

[jwmoss]

Changes

• Add --module-layout resources for roots that call individual Registry modules.
• Keep the workspace layout as the default. Preserve selection, scope, object keys, and import IDs.
• Emit matching module inputs and imports. Pin resource modules to 0.1.0 by default.
• Use explicit Registry hostnames in the resource layout for Terraform and OpenTofu.
• Document layout selection, state boundaries, and the OpenTofu example.
• Test both layouts and scopes with fake APIs and the real provider.

This adds no resource types or API reads. It does not migrate an existing state.
The canonical export.json format stays unchanged.

Validation

• DATATF_TELEMETRY=0 make check
• shellcheck scripts/e2e-fake.sh and shfmt -d scripts/e2e-fake.sh
• gocyclo -over 8 on the changed Go files: no findings
• goreleaser check
• Terraform 1.15.6: both layouts, both scopes, Registry modules, provider 1.131.0
• OpenTofu 1.12.6: resource layout, both scopes, Registry modules, provider 1.131.0

Each local round trip imports 27 workspace and 8 shared resources without other changes.
Each second plan has no changes. These tests use fake workspace APIs, not Azure.

PR CI passes on Linux and Windows for 74808a1905552e02152d341b8afe8db520de24b6.

Live Azure validation passes on that exact commit with Terraform 1.16.1,
Databricks provider 1.131.0, and all ten resource modules at 0.1.0:

• 49 workspace imports and 5 shared imports; no creates, updates, or deletes
• No changes in either second plan
• Coverage matches all 13 resource types in the resource matrix
• Repeated JSON exports, Terraform inputs, and import blocks match
• Fixture removal and cleanup checks pass; the fixture state is empty

The private workflow retains the reviewed plans and version evidence for seven days.
No existing production state is migrated. Generated roots still require Terraform 1.7 or later.