Feature/gho 22

[noahwhite]

GHO-22: Add OpenTofu formatting check to PR CI

Summary

This PR implements a GitHub Actions workflow that enforces canonical OpenTofu formatting on pull requests targeting the develop branch. The workflow runs tofu fmt -check -recursive in CI and blocks merges when formatting issues are detected.

The implementation intentionally minimizes complexity and avoids secret management tooling, wrappers, or non-essential OpenTofu commands.

---

Acceptance Criteria Mapping

Acceptance Criteria	Status
Workflow runs for PRs with develop as base branch	✅
Repository is checked out	✅
OpenTofu is available via a pinned, containerized toolchain	✅
tofu fmt -check -recursive runs against the repo	✅
Workflow fails clearly on formatting violations	✅
Workflow does not run for PRs targeting other branches	✅
No Bitwarden Secrets Manager usage	✅
Does not invoke infra-shell.sh or tofu.sh	✅
Does not run tofu init, validate, plan, or apply	✅

---

Key Changes

• Adds a GitHub Actions workflow to run OpenTofu formatting checks on PRs targeting develop
• Uses a containerized OpenTofu toolchain for deterministic behavior
• Explicitly specifies the GHCR username to avoid ambiguity with github.actor
• Authenticates to GHCR using a scoped GitHub Actions secret (GHCR_TOKEN)
• Limits workflow triggers to relevant PR events (opened, synchronize, reopened)

---

Behavior

• Formatting violations cause the CI job to fail and block merge into develop
• CI output lists the files requiring formatting
• No formatting is auto-applied in CI

To remediate failures locally:

tofu fmt -recursive

[linear]

GHO-22 [User Story] Add OpenTofu formatting check to PR CI (no secrets)