Add Terraform fmt, validate, and fixture-plan PR check for infra/**

[cookieofcode]

Summary

Adds a lean GitHub Actions PR check so every PR to main reports a Terraform status: run fmt / validate / offline plan when infra/** (or this workflow) changed, or succeed with an explicit skip otherwise. Never apply.

New workflow: .github/workflows/terraform.yml (same style as ci.yml plus the PR #12 e2e path pattern).

Required-check fix (Quality should-fix)

on.pull_request.paths was removed. Path filters live in a Paths job (same idea as PR #12’s e2e changes job): list PR files via gh api, set terraform=true only for infra/** and .github/workflows/terraform.yml. The job named Terraform always runs (if: always() && !cancelled()):

• no matching paths → green skip (so a required check is never pending on app-only PRs)
• matching paths → terraform fmt -check + infra/azure/scripts/check-env-gates.sh

What a run covers

check-env-gates.sh:

• terraform init -backend=false + validate on the workload root and bootstrap/
• terraform test (command = plan) in infra/azure/tests/env-gate/
• drift checks so the offline copy stays aligned with variables.tf / locals.tf / identity.tf viewer skip / the TLS-on load_balancer_ip = null expression from PR Use null for Service load_balancer_ip to unblock TLS enable_tls plan #11

No terraform apply. No Azure login, OIDC, backend, or Key Vault.

Env-gate: wired, not duplicated

Quality noted infra/azure/tests/env-gate was unused by PR CI. Reuse is clean: the script already validates both roots and plans the provider-free gate module. A second parallel test root would only drift.

A full terraform plan of infra/azure/ is not in this check. That still needs az login and a real Key Vault (ephemeral.azurerm_key_vault_secret cannot be mocked). Accepted gap.

Fixtures (no real secrets)

Plan runs with enable_tls=true (hostname ci.example.test, reserved test TLD):

Run	What it proves
prod_tls_enabled_plans	Prod + TLS plans; Service is ClusterIP; load_balancer_ip is null (not ""); empty aks_viewer_user_object_ids
dev0_tls_enabled_plans	Non-prod TLS-on also plans
viewer_one_fixture_id	One placeholder viewer GUID is kept
viewer_skipped_when_admin	Viewer GUID that overlaps aks_admin_user_object_ids is skipped
viewer_skipped_when_apply_principal	Viewer GUID that matches the apply-principal stand-in is skipped

Placeholder Entra UUIDs only (…0000a1 admin, …0000b2 viewer, …0000c3 apply principal). HTTP fixture IP is 192.0.2.10 (TEST-NET-1 / RFC 5737). No subscription IDs, real object IDs, Key Vault names, or ACME accounts.

FinOps

No Azure resources added or resized. No cost report in this PR (CI YAML + offline tests only).

Why

After PR #11 (enable_tls=true broke plan on empty-string load_balancer_ip), Quality flagged that CI was Lint & Build / Playwright only — no Terraform seam. PR #10 added aks_viewer_user_object_ids skip-when-admin. Quality then asked that the check always report (skip vs run) so it can be a required merge check without blocking app-only PRs. Apply stays gated.