refactor: replace repeated loaded/err/data cache triples in checklistRunner with a generic lazycache

[nathanhuh]

Summary

`checklistRunner` in `internal/inspector/checklist.go` has 14 fields implementing the same `loaded bool / err error / data V` cache pattern for each AWS resource type (RDS, hosted zones, etc.). The pattern is duplicated by hand, making it easy for the invariant — `err == nil iff loaded == true && data is valid` — to be violated inconsistently across resource types.

Details

• Each new resource type cached requires adding 3 fields in sync (`xLoaded`, `xErr`, `xByID`)
• A bug in loading one resource type (e.g., setting `loaded` before clearing `err`) won't be caught and won't affect other types — silent inconsistency
• Go 1.18+ generics make this straightforward to unify

Checklist

• Define a `lazycache[V any]` struct with fields `loaded bool`, `err error`, `data V`
• Add a `get(load func() (V, error))` method that initializes on first call
• Replace all 14 `xLoaded/xErr/xByID` field groups in `checklistRunner` with `lazycache[...].`
• Update all read sites to use the new type
• Verify `checklist_test.go` tests still pass

References

• `internal/inspector/checklist.go:323-362`

Raised from senior code review (2026-05-12).