ci: lock terraform providers for darwin_arm64 + linux_amd64

[nbrieussel]

Problem

The committed .terraform.lock.hcl files only contained provider hashes for a single platform (darwin_arm64). On a Linux CI runner (or with -lockfile=readonly), terraform init would fail or silently mutate the lock, creating churn across machines.

Closes #16

What changed

Lock files (all 3 roots re-locked for both platforms):

• state-backend/.terraform.lock.hcl — adds linux_amd64 hashes for scaleway/scaleway
• cluster/local/.terraform.lock.hcl — adds linux_amd64 hashes for hashicorp/helm, hashicorp/kubernetes, infisical/infisical
• cluster/scaleway/.terraform.lock.hcl — adds linux_amd64 hashes for all 6 providers

CI (.github/workflows/terraform-lock.yml):

• Matrix job over the 3 roots running terraform init -backend=false -lockfile=readonly
• -backend=false skips Scaleway/S3 backend credential requirements in CI
• -lockfile=readonly turns an incomplete lock into a build failure instead of a silent mutation
• Pinned to commit SHAs, minimal contents: read permission, persist-credentials: false — mirrors lint-workflows.yml style
• Triggered on changes to any .terraform.lock.hcl, any version.tf, or the workflow itself

Tooling (mise.toml):

• New mise run lock task: re-runs providers lock -platform=darwin_arm64 -platform=linux_amd64 for all 3 roots in one shot. Devs and CI share the same invocation pattern.

Docs (CLAUDE.md):

• Documents mise run lock in the Commands section
• Documents when to re-run (provider version bump, new provider, CI failure) with the equivalent raw commands for reference

terraform fmt:

• Applied formatting fixes to cluster/local/main.tf, variables.tf, and version.tf (whitespace/alignment, no logic changes)

How to verify

1. Pull the branch and run actionlint .github/workflows/*.yml — must pass with no output.
2. Run grep -c 'h1:' {state-backend,cluster/local,cluster/scaleway}/.terraform.lock.hcl — each root should report at least 2 (one per platform per provider).
3. On a Linux machine or Docker container: docker run --rm -v $(pwd):/repo hashicorp/terraform:1.14 -chdir=/repo/state-backend init -backend=false -lockfile=readonly — must succeed.
4. The CI workflow will run automatically on this PR.

Reviewer notes

• The infisical/infisical provider is self-signed; that's expected and pre-existing. Both platforms' hashes were fetched from the official registry.
• cluster/local is pinned to infisical 0.16.10 and cluster/scaleway to 0.16.26 — these were already diverged before this PR and are intentionally left as-is (a separate bump can align them).
• The hashicorp/setup-terraform action is pinned to the v3.1.2 commit SHA (b9cd54a3c349d3f38e8881555d616ced269862dd), matching the version in mise.toml (terraform = "1.14").

🤖 Generated with Claude Code

[nbrieussel]

praise: clean first pass — 3 roots re-locked for both platforms, SHA-pinned workflow mirroring lint-workflows.yml, mise run lock + CLAUDE.md docs all present.

issue (fixed in 8f10999): the original check ran terraform init -backend=false -lockfile=readonly on an ubuntu runner. That catches a lock missing linux_amd64 hashes, but a darwin-only regression (e.g. a provider bumped + terraform init run on the Mac) would pass CI green while silently breaking local dev. Swapped it for terraform providers lock -platform=darwin_arm64 -platform=linux_amd64 + git diff --exit-code per root — this fails on a lock incomplete for either platform, independent of the runner OS, which is the policy the issue actually asks for. Verified locally: re-locking the committed files produces zero diff (deterministic/stable).

thought (out of scope): cluster/local pins infisical 0.16.10 vs cluster/scaleway 0.16.26 — pre-dates this PR, worth a follow-up issue.

[nbrieussel]

Pris en compte dans bf13b93 : retiré le trigger push, le workflow tourne désormais sur pull_request uniquement (tout passe par une PR). J'en ai profité pour squasher la PR en un seul commit.