test(clusterapi): EKS ownership refusals in the default capture path are unpinned

> 🤖 Generated by the Agentic Engineer

## Evidence

Measured on #6434 at `573b9995b5`. The EKS ownership guard's injected seams are thoroughly tested; the **default production path** is not.

| function | coverage (full `pkg/cli/clusterapi` run) |
|---|---|
| `resolveEKSMutationGuard` | 95.0% |
| `normalizeEKSVerificationError`, `applyEKSMutationGuard`, `captureEKSOwnership`, `newEKSCreateIdentity`, `eksOwnershipResolver` | 100% |
| **`defaultEKSCapture`** | **0.0%** |
| **`defaultEKSGuard`**, `eksIdentityClient`, `eksIdentityClientFor` | **0.0%** |

`defaultEKSCapture` is the function actually wired in at `local_service.go:187` (`service.captureEKSIdentity = service.defaultEKSCapture`). Tests inject their own capture, so the real one never executes.

**Ablation.** Replacing the refusal in `defaultEKSCapture` with `return nil`:

```go
if identity == nil {
return nil // was: refuse with ErrEKSOwnershipEvidenceMissing
}
```

leaves the suite at **28 RUN / 28 PASS / 0 FAIL** — byte-identical to the unablated run. A security refusal can be deleted from the production path with no test failing.

## Why this is not just untestable AWS glue

`eksIdentityClient` / `eksIdentityClientFor` genuinely construct AWS clients, and leaving those uncovered is reasonable. `defaultEKSCapture` is different: its `identity == nil` and `bound == nil` branches **return before any AWS call**, so they are reachable with no credentials, no network, and no eksctl config. They are ownership decisions, and they are exactly the branches the ablation showed are unpinned.

## Expected

Deleting or inverting a refusal in `defaultEKSCapture` fails a test.

## Acceptance criteria

- [ ] `defaultEKSCapture` refuses when `bound == nil` — covered
- [ ] `defaultEKSCapture` refuses when `identity == nil` — covered
- [ ] Ablation recorded: each new test is shown to **fail** with its refusal removed, not merely to pass with it present
- [ ] `defaultEKSGuard` assessed — cover the pre-AWS branches or record why it is glue-only

Found while user-evaluating #6434. Not a blocker for that PR, which is a large net improvement. Size: S.

Start at pkg/cli/clusterapi and the wiring in local_service.go:187, then trace defaultEKSCapture and defaultEKSGuard. Add coverage for the bound == nil and identity == nil refusals, assess the pre-AWS branches in defaultEKSGuard, and run the full package suite. Done means removing each refusal causes its new test to fail, with the ablation recorded.

Written by the indexing model from the issue text.