Function ensure_default_instance 

pub fn ensure_default_instance(
    state: &SharedSsoAdminState,
    account_id: &str,
    region: &str,
)

Seed a default, always-ACTIVE IAM Identity Center instance for account_id when it has none. Real AWS requires enabling IAM Identity Center before instances exist, but seeding one makes the control plane (and the paired Identity Store directory) usable out of the box — and lets tools that first resolve ListInstances (e.g. Terraform’s aws_ssoadmin_instances) proceed. The instance id is derived from the account id so it is stable across restarts. No-op if an instance already exists (e.g. restored from a snapshot).