test(ci): tighten destroy-script guards and test fixtures from the #484 and #486 reviews #489

Non-blocking review nits from #484 and #486, batched so they don't hold up the Fargate dev cleanup.

scripts/force-delete-owned-ecr-repo.sh (from the #484 review):

• ~line 99: the not-found check matches RepositoryNotFoundException anywhere in stderr. Anchor it to the error name, (RepositoryNotFoundException).
• ~line 82: no guard against an empty or whitespace repository name, unlike the RDS script. The AWS CLI rejects an empty name with exit 252, so it fails safe today, but copy the RDS script's [:graph:] case guard for a clear error.

scripts/test-rds-deletion-protection-scope.sh and scripts/disable-owned-rds-deletion-protection.sh (from the #486 review):

• ~line 546: the null-value test case leaves TF_STATE_LIST unset, so the stub's failure also yields exit 1. A mutant that makes the null case consult state list survives. Set an instance-free TF_STATE_LIST in that case.
• script ~line 136: dropping the (^|\.) anchor in the instance regex survives the suite. Add a fixture with an address that only contains the text, for example aws_ssm_parameter.x_aws_db_instance.main.