fix(state): resolve state bucket region in exports index store - #824

PR #803 fixed LockManager to resolve a cross-region state bucket's actual
region via GetBucketLocation before any S3 op. The automated
cross-region-state-bucket integ then surfaced that the exports index store
(Fn::ImportValue cross-stack reference tracking, writes
_index/{region}/exports.json) had the same unfixed bug: its S3 client was
pinned to the CLI base region, so against a bucket in another region every
index write (after deploy) and remove (after destroy) hit S3's 301
PermanentRedirect, logged as "Exports index ... failed (non-retryable): ...
must be addressed using the specified endpoint; continuing without index
update". Non-fatal by design (the canonical state.json is written through
the already-region-corrected S3StateBackend and the index self-heals), so
the run passed while the cross-region index was silently never maintained.

Port the LockManager.ensureClientForBucket() pattern into ExportIndexStore:
before its first S3 read (readIndexRaw) or write (writeIndex) it resolves the
bucket's region (cached process-wide via resolveBucketRegion, so it shares
the state backend's / lock manager's existing GetBucketLocation call) and,
if it differs from the supplied client's region, builds a private
replacement S3Client for that region. The replacement reuses the caller's
resolved credentials (so --profile / static creds carry over without
threading client options through the four store call sites) and does NOT
destroy the shared AwsClients.s3 instance other components still hold. The
resolution is memoized + single-flight, and degrades gracefully for a test
double whose client lacks the SDK config.region() shape. Contained inside
the store, with no ripple to deploy.ts / destroy.ts / state.ts /
local-state-loader.ts.

Tests: 4 new unit tests (removeStack + updateForStack succeed through a
region-corrected client when the bucket region differs; no rebuild when the
resolved region matches; region resolved exactly once across multiple ops).
Integ: the cross-region-state-bucket fixture stack now publishes a
CloudFormation Output with an Export.Name (an export-less stack
short-circuits the index write), and verify.sh greps the deploy + destroy
output to assert the exports-index 301 warning is gone on both paths and
that _index/{region}/exports.json was written to the cross-region bucket on
deploy. New scenario tag exports-index-region-resolve.

Closes #819