test(clusterapi): assert the EKS ownership guard refuses Start, not only Stop

> 🤖 Generated by the Agentic Engineer

## Evidence

`Start` and `Stop` both route through `runLifecycleAction` → `runGuardedProvisioner`
(`pkg/cli/clusterapi/local_service.go:840`), so both carry the EKS ownership guard. The test suite
covers that refusal for `Stop` only — `TestStopEKSRefusesWhenOwnershipCannotBeVerified` — with no
`Start` equivalent.

Measured while validating #6203: ablating the guard flips 9 tests, none of which exercise `Start`.

## Affected audience and impact

No user-visible gap today: the protection is shared by construction, so `Start` is guarded. The risk
is regression-shaped — a future refactor that gives `Start` its own path (or reorders the guard for
one action) would lose the ownership check on `Start` with the suite still fully green.

## Expected behaviour

The guard's refusal is asserted for every guarded mutation, not just delete and stop.

## Acceptance criteria

- A `Start` arm asserts the mutation is refused when ownership cannot be verified, mirroring
`TestStopEKSRefusesWhenOwnershipCannotBeVerified`.
- The new arm fails when the guard is ablated (a passing test that survives the ablation is proving
nothing).

## Rough size

Small — one test arm in `pkg/cli/clusterapi`.

Start in pkg/cli/clusterapi/local_service.go at runLifecycleAction and runGuardedProvisioner, then read TestStopEKSRefusesWhenOwnershipCannotBeVerified. Add the corresponding Start test arm in the clusterapi test suite, mirroring the Stop refusal. Done means Start is refused when EKS ownership cannot be verified and the test fails if the guard is ablated.

Written by the indexing model from the issue text.