fix(export): write a moved block when an exported resource is re-keyed

[2000game]

Closes #199

What

When a resource keeps its id but gets a new ct key, ct export tf now compares each id with the label the id map recorded and writes a moved { from = <old>, to = <new> } block at the top of imports.tf. Before, the old address simply lost its config and tofu plan proposed destroying it (or failed on prevent_destroy).

Deviation from the issue: the import block stays

The issue suggested dropping the import block for a moved resource. That would plan a create (a duplicate) whenever the old address never reached tofu's state, e.g. an export that was never applied. Checked locally with OpenTofu 1.12.5 and random_id:

State	Blocks	tofu plan
old address in state	moved + import	moved, 0 to add, 0 to change, 0 to destroy
empty state	moved + import	1 to import, 0 to add

So both blocks are written, and both cases come out right.

Limitation (documented)

The id map is the only record of the old label. A default export also rewrites the map, so a second export before applying loses the moved block. Documented in docs/opentofu-migration.md: apply on each host before re-exporting, or export with --no-ids and refresh with ct ids sync.

Checks

lint, typecheck, test (1276 passed), build all green locally; 4 new tests in tests/export/export-tf.test.ts.

[2000game]

Review (/code-review high), each finding verified before acting:

• Fixed — swap / key reuse. Reproduced with OpenTofu: a moved whose from is still declared fails plan with "Moved object still exists"; leaving it out instead updates the wrong object in place. Such moves are now skipped with an EXPORT_MOVE_CONFLICT warning (manual tofu state mv), documented.
• Fixed — --no-ids now read the id map. On main a --no-ids export without references never loaded it; this branch made a corrupt map fatal. The move lookup now tolerates it (EXPORT_MOVES_SKIPPED); references that need the map still fail as before.
• Not changed — second export loses the move. Already the documented limitation; keeping the old label in the map would point references and ct ids sync at a stale address. --only heals itself, since uncovered map entries carry over.
• Not changed — shared tofu/ across hosts. imports.tf is already per-host-at-a-time (import ids differ between hosts); maps are per host, so each host's export derives its own moves.
• Not changed — unvalidated map labels / repeated map reads. Labels come from hclLabel or tofu addresses via ct ids sync; the extra reads are minor.

3 regression tests (fail before, pass after). Ran the built CLI end to end: re-key → moved block, swap → warning and no block, corrupt map + --no-ids → exit 0 with warning.