test(filters): pin the CSV-path ambiguous-exclude refusal in filterAndAdjustRecommendations #2252

Follow-up to #2251. This came from the independent review at b83cbd5.

In requireFilterInputs (cmd/multi_service.go:960), I replaced requireResolvedAccountNames with requireNamesResolved. That removes the ambiguous-exclude check from the CSV replay path, and no test failed.

TestRequireExactExcludes calls the wrapper directly, so nothing covers the CSV call-site wiring. The behaviour is correct today: the built binary with a CSV fixture and --exclude-accounts prod exits 1 with the "matches no account exactly" error before any AWS call.

Ask: add a test that sends a partial exclude through filterAndAdjustRecommendations. Assert the error and that no recs are returned. That way the probe above fails.