bug(aws/recommendations): RateLimiter.Reset race after #269 parallelised GetAllRecommendations

[cristim]

Problem

go test -race ./providers/aws/recommendations/... reports concurrent
writes to (*RateLimiter).Reset after PR #269 parallelised the AWS
service-loop:

WARNING: DATA RACE
Write at 0x... by goroutine N:
  recommendations.(*RateLimiter).Reset()
      providers/aws/recommendations/ratelimiter.go:132
  recommendations.(*Client).GetRecommendations()
      providers/aws/recommendations/client.go:83
  recommendations.(*Client).GetRecommendationsForService()
      providers/aws/recommendations/client.go:158
  recommendations.(*Client).GetAllRecommendations.func{1..5}()
      providers/aws/recommendations/client.go:215

Root cause: Client.rateLimiter is a single *RateLimiter instance
held on the Client struct (client.go:28). Both Reset() and the
internal state mutated by Wait / ShouldRetry / GetRetryCount are
shared across the 5 per-service goroutines launched in
GetAllRecommendations. None of those methods take a lock.

Why it's not been visible

• The project's default go test invocation doesn't pass -race.
• The pre-commit hook runs go test without -race.
• All standard tests pass (the race produces interleaved-state behaviour
  that doesn't typically cause assertion failures, just throttling
  imbalance and inflated retry counts in production).

Acceptance criteria

• go test -race ./providers/aws/recommendations/... passes from
  providers/aws/.
• Either:
  • (a) Lock the rate-limiter's mutating methods with an internal
    sync.Mutex (preserves the shared-state-across-services design); or
  • (b) Make each per-service goroutine instantiate its own
    RateLimiter (no shared state) — preferred since AWS Cost Explorer
    rate limits are per-API-call, not aggregate, so the shared limiter
    isn't actually doing useful coordination.
• Add -race to the pre-commit go test invocation (or to a
  CI-only matrix entry) so future regressions are caught.

References

• Introduced by: perf: parallelize recommendations collection at every level (closes #266 #267 #268) #269 (defac6c2a) — the parallelised
  GetAllRecommendations exposes pre-existing single-threaded code to
  concurrent callers.
• Surfaced during PR perf: aggregate parallelism cap + 2 GB Lambda for collect refresh (followup #269) #270 CR loop while running -race to validate
  unrelated test changes in pkg/concurrency.