fix: treat an empty machine.ami_id as the fallback, not a missing value

[7174Andy]

Summary

lablink doctor fails the configuration #489 recommends.

#489 makes an empty machine.ami_id resolve AWS's Deep Learning Base AMI for the
deployment's region (data.aws_ami.default_client), which is how a lab runs somewhere
LabLink publishes no image of its own. But _check_ami, merged in #484, treats empty as a
missing value:

Client AMI  FAIL  No machine.ami_id set. For us-west-2, use ami-0601752c11b394251

I wrote both, and they disagreed. Empty is not a gap — it's a request.

What changes

Empty now resolves the same image the deployment would, picks the newest to match
most_recent, and reports it:

Client AMI  PASS  empty → ami-0d7a7be9ba394534e (Deep Learning Base OSS Nvidia Driver GPU AMI (Ubuntu 24.04) 20260828) in eu-west-1

• fail only where AWS publishes no such image in that region to fall back to,
  suggesting the region's published LabLink image when there is one.
• warn, not fail, when the lookup itself cannot run — no credentials, no
  ec2:DescribeImages, network trouble. Unverified is not the same as wrong.

The name filter is duplicated from the client terraform, with a comment saying so. That
duplication is deliberate: verifying a different image than the deployment resolves would
be worse than not checking at all, so the two have to be kept in step, and the comment is
where the next person finds that out. (Ubuntu 24.04) stays pinned because 26.04 is
published on the same dates — a new 26.04 appeared overnight while this was being written.

Second, smaller fix: a wrong-region AMI in a region with no published LabLink image now
suggests clearing the field, which is the one-step fix, rather than only suggesting an
aws ec2 copy-image job. That is the case a real operator hits:

Client AMI  FAIL  ami-0601752c11b394251 does not exist in eu-west-1 — clear machine.ami_id
                  to resolve a Deep Learning Base AMI for eu-west-1 automatically, or copy
                  an image from us-west-2, us-east-1, us-east-2 into eu-west-1

Testing

packages/cli: 822 passed, 1 deselected
ruff check packages/cli: All checks passed!

Four new cases: empty resolves the newest match (asserting the older candidate is not
chosen, so the sort is actually exercised), empty fails where nothing is published, empty
warns when unverifiable, and the wrong-region message names the one-step fix.

Related

• feat: default the client AMI to a per-region Deep Learning Base AMI #489 — the terraform side. Merge that first; this PR describes behaviour it
  introduces, so on its own it makes doctor optimistic about a config the allocator would
  still reject.
• fix: verify the client AMI exists instead of trusting AMI_MAP #484 — merged, introduced _check_ami's EC2 verification.
• fix: make app.region actually drive the deployment, and boot the allocator from stock Ubuntu lablink-template#70 — merged, moved the allocator to a per-region stock image,
  which is what left the client AMI as the only region-scoped value.