refactor: reorganize terraform roots by domain (strata-prefixed)

[nbrieussel]

Context

The top-level Terraform roots had grown into a flat, unstructured set. This
reorganizes them by domain (top-level folder = responsibility) with a
numeric strata prefix on each root (apply order / blast-radius / who applies
it). cluster/* is left untouched.

New layout

modules/                 # NEW — future reusable modules
state/                   # domain: Terraform state
  00-backend/            #   was terraform-state-bucket   (S3 bucket; admin-applied)
  10-access/             #   was s3-lister-role            (org-wide state-read role; CI-applied)
identity/                # domain: CI identity & governance
  00-ci-trust/           #   was aws-github-oidc           (OIDC + role-creator + boundary + grant)
ci/                      # domain: CI access
  10-scaleway/           #   was github-ci                 (Scaleway read-only key)
cluster/                 # UNTOUCHED (local/, scaleway/)

Zero state migration (the key design point)

State is addressed by the backend config, not the directory path. Every root
keeps its existing workspace_key_prefix, so the relocated roots bind to
their existing remote state with no migration — this is a pure git mv. The
prefix now intentionally differs from the path (documented in each version.tf).
No resources are recreated → all ARNs/keys stay stable (AWS_GITHUB_ACTIONS_ROLE_ARN,
AWS_S3_LISTER_ROLE_ARN, GitHub secrets, the s3-lister trust). No
terraform_remote_state coupling exists between roots, so no cross-root lookups break.

Reference updates

• mise.toml — lock paths; tasks renamed github-ci-*→scaleway-ci-*, aws-github-oidc-*→ci-trust-*.
• CLAUDE.md — architecture tree + per-root sections, mise run lock list, boundary-contract path.
• .github/workflows/ — path filters, terraform-lock matrix, s3-lister-role.yml composite-action root: input.
• READMEs — top-level + the three relocated per-root READMEs.
• Added modules/README.md.

Test

• terraform fmt -check ✓ · each moved root init -backend=false && validate ✓ · actionlint ✓
• CI on this PR exercises the new paths end to end: the terraform-lock matrix,
  and s3-lister-role.yml applies state/10-access against its unchanged
  state key → proves the relocated root still binds to existing state (expect a
  no-op apply).
• Gold-standard local check (optional): aws sso login, then
  terraform -chdir=<moved-root> init && plan → no changes.

Notes

• issue (minor/cosmetic): two Scaleway resource descriptions in
  ci/10-scaleway/main.tf still say (managed by terraform: github-ci/). Left
  as-is on purpose — editing a resource argument would force a plan diff, breaking
  the "pure move, zero change" guarantee. Fix in a later trivial apply if desired.
• thought: local/gitignored OpenSpec drafts openspec/changes/terraform-ci-*
  reference github-ci/; they'd later target ci/11-scaleway-tf. Out of scope.