fix(csv): zonal EC2 rows lose their AvailabilityZone in the CSV round-trip and dry run misses the refusal #2174

Found by the cli#2132 pin-bump author (PR #2173 report), confirmed with a round-trip probe.

After the go bump that brings fb39c9d (go#305), a zonal EC2 RI is bought in the recommendation's AZ and a zonal rec with no AZ is refused before any AWS call. The CLI CSV writer and reader carry Scope but not AvailabilityZone, so a zonal EC2 row that goes through --input-csv loses its AZ and is now refused (before the bump it bought in an arbitrary AZ). Fail-closed is the right direction, but:

1. The CSV export/import must round-trip the AZ for zonal EC2 rows (new column or an explicit documented encoding), with a test of write -> read -> purchase path using a zonal row.
2. The dry-run precondition check does not look at the AZ, so a dry run reports success where the real run refuses. Dry run must apply the same refusal.
3. Document the CSV schema change (and note the interaction with the open CSV contract work in fix(cli): validate CSV headers, encoding and numeric bounds #2145 and owner item 42; coordinate before changing the header set).

Related: platform#792 (AZ-scoped EC2 recs), go#305.