fix(pam): exclude already-governed collections from the access-rule collections picker

[maxkpower]

Design review 2026-09-04: the save error names no collection, so an admin cannot tell which one conflicts. The server sends prose with no ids (AccessRuleWriteValidator), so prevention is the only fix: collections governed by another rule are no longer offered.

Note the conflict is Collection.AccessRuleId != existingRuleId, so a disabled rule still governs. The server error stays as the backstop, since the read is cached for 30s.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.05%. Comparing base (e7321e3) to head (1b4ff17).
⚠️ Report is 288 commits behind head on pam/uat.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##           pam/uat   #23000      +/-   ##
===========================================
+ Coverage    55.74%   56.05%   +0.31%     
===========================================
  Files         4438     4467      +29     
  Lines       141404   143064    +1660     
  Branches     22371    22594     +223     
===========================================
+ Hits         78824    80201    +1377     
- Misses       56914    57113     +199     
- Partials      5666     5750      +84     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.