lambda/image: copy image with skopeo, support aws provider v6

[sorah]

Replace the docker-based image copy in the Lambda terraform with skopeo, and bring the modules up to AWS provider v6.

skopeo migration

• copy image with skopeo not docker — replace the docker login/pull/tag/push shell script with a single skopeo copy run directly from the local-exec provisioner. The destination ECR credential comes from an ephemeral aws_ecr_authorization_token so it never lands in state, and is fed over stdin into a temporary authfile rather than a command-line argument to keep it out of the process argument list.
• copy gains architecture input — skopeo copy defaults to --multi-arch system, selecting the image matching the host running Terraform rather than the Lambda's architecture. The new architecture input pins the platform via --override-os/-arch so the correct single-platform image is copied out of the multi-arch source index regardless of where apply runs. It uses Lambda's notation (x86_64/arm64), mapped to linux/amd64 and linux/arm64 internally.
• seed authfile so skopeo login can read it — mktemp creates a 0-byte file, but skopeo login reads the authfile to merge the new credential before writing it back. An empty file is invalid JSON, so login aborted with unexpected end of JSON input and copy-image never ran. The authfile is now seeded with an empty JSON object first.

AWS provider v6

• drop registry_id — the aws_ecr_authorization_token ephemeral resource no longer accepts registry_id under v6; it only issues a token for the caller's own default registry, which already covers the repo created in the same account.
• aws_region.current.region — the .name attribute on the aws_region data source is deprecated in favor of .region. Both modules are pinned to >= 6.0.

Misc

• terraform/iam: role_name output — expose the created role name.
• terraform/README: reflect skopeo-based image copy.