terraform bootstrap: Layer 0 is the CI machinery only

[zah]

Why

Operators keep having to log in to AWS to apply Layer-0 changes that have nothing to do with running Terraform in CI. The rule this PR enforces in the shared modules:

The true bootstrap resources are the ones related to the infrastructure of running terraform plan and apply in CI, nothing else.

The full classification of every bootstrap resource in the three infra repos, the migration plan, its failure modes and the resulting login cadence are in metacraft-pm infrastructure/terraform-bootstrap-boundary.md (7d19632).

What changes

terraform/github/tf-bootstrap.nix now renders only the CI-authentication plumbing: AWS_TERRAFORM_{PLAN,APPLY,DRIFT}_ROLE_ARN and BACKEND_CONFIG_FILE. The following move to each consumer's CI-applied governance root:

• the reviewer team, its memberships and its repository grant;
• the sensitive-change / allow-destroy labels;
• the production Environment;
• the deploy branch's classic protection.

For each of those old addresses, the module emits removed { lifecycle { destroy = false } }. additionalMaintainers logins are included.

terraform/aws/tf-bootstrap.nix no longer renders the monthly budget, the 13 cost-allocation tags or the 4 cost categories. Their addresses get the same removed handling. The break-glass role stays: CI must not be able to write a role that holds AdministratorAccess.

budgetAlertEmails, manageCostAllocation, reviewerTeam, requiredStatusCheckContexts and enforceAdmins are still accepted, so existing callers evaluate unchanged. Consumers pin these modules by rev, so nothing changes for anyone until they bump. The required order is: import into the CI root first, then bump.

Driver regression test. terraform/github/tests/test-github-bootstrap-driver.sh covers plain plan / apply / outputs on a root without a governance secret manifest, with PATH-stubbed tools. It fails against 335db9d ("No github-governance-app secrets found") and passes on dev, where 0b9e93d fixed the bug. metacraft-labs/infra still pins the driver at 335db9d; the consumer PRs bump that pin.

Verification

I rendered each of the six consumer roots at its current pin and at this branch, then diffed the resources:

Root	Dropped (now removed)	Changed
github metacraft-prod / agent-harbor-prod	team, membership, grant, 2 labels, environment, branch protection	none
github blocksense-prod	same + infra_maintainer_zah	none
aws agent-harbor-prod	budget, 13 cost-allocation tags, 4 cost categories	none
aws blocksense-prod	same	terraform_apply_managed_iam +iam:ListInstanceProfilesForRole (old pin predates af54587)
aws metacraft-prod	budget	same +iam:ListInstanceProfilesForRole

Other checks:

• terranix passes removed through, and tofu validate succeeds on the rendered GitHub example.
• terraform/github/tests/test-bootstrap-render.sh, terraform/aws/tests/test-render.sh (extended), terraform/aws/tests/test-shared-oidc.sh and the new driver test all pass.

[github-actions]

Thanks for your Pull Request!

Below you will find a summary of the cachix status of each package, for each supported platform.

package	x86_64-linux	x86_64-darwin	aarch64-darwin