Terraform CI workflow: fmt, validate, and plan on PR

[cursor]

Parent

#105

Spec

spec/features/014-cicd-infrastructure/spec.md

What to build

Add GitHub Actions workflow triggered on PRs touching infra/terraform/:

1. Checkout
2. Setup Terraform (pinned version)
3. terraform fmt -check -recursive
4. terraform init + validate for bootstrap and environment roots
5. terraform plan (read-only; may use OIDC dev role or skip AWS credentials if validate-only suffices for fmt/validate)

Separate workflow_dispatch apply workflow (prod uses GitHub Environment production with required reviewers). No auto-apply on merge.

Acceptance criteria

• PR workflow fails on fmt drift or validate errors
• Plan output visible in PR checks for infra changes
• Apply workflow is manual dispatch only
• Prod apply requires production environment approval

Blocked by

#107, #108, #109

Type

AFK