ci: plan cluster/scaleway via the org-wide s3-lister role over OIDC

[nbrieussel]

Context

Goal: a GitHub Action that reproduces, in CI, what we validated by hand — assume the org-wide s3-lister IAM role and run a terraform plan of cluster/scaleway. Per design, the role is assumed directly via GitHub OIDC (no routing through the bootstrap CI role, whose sole job is creating/updating roles).

Changes

s3-lister-role/ — make the role directly OIDC-assumable, org-wide

• Add a federated GitHub-OIDC trust statement (sts:AssumeRoleWithWebIdentity, sub StringLike repo:IntegratedDynamic/*) via the module's enable_github_oidc + oidc_wildcard_subjects. Any repo in the GitHub org can assume it keylessly.
• The existing aws:PrincipalOrgID trust is kept — both doors coexist.
• use_name_prefix = false → stable name s3-lister / stable ARN (one-time role replacement, applied by s3-lister-role.yml).

.github/workflows/scaleway-plan.yml — the new workflow

• OIDC → assume s3-lister directly → terraform init + plan on cluster/scaleway.
• Shaped by the read-only role: plan-only, -lock=false, TF_WORKSPACE=infrastructure (existing workspace, no write), bootstrap_argocd=false (no Infisical/in-cluster providers in CI).
• Scaleway refresh uses the static SCW_* creds from secrets (Scaleway is not an OIDC relying party).
• Triggers: PR on cluster/scaleway/**, s3-lister-role/**, the workflow file + workflow_dispatch.

Also set repo variable AWS_S3_LISTER_ROLE_ARN to the stable ARN.

Notes / review points

• issue: First-PR sequencing — the trust change + role rename are applied by s3-lister-role.yml; ordering vs scaleway-plan on this same PR isn't guaranteed, so the plan job may fail on the very first run (trust not yet applied). Re-run after the apply completes.
• thought: CI plan is bootstrap_argocd=false (cluster infra only), unlike the full local plan — a deliberate trade-off given the read-only role + no Infisical creds in CI.

Test

• terraform validate (s3-lister-role) ✓, actionlint ✓
• terraform plan on s3-lister-role confirms the GithubOidcAuth statement + name change
• Manual end-to-end (assume role → plan -lock=false on cluster/scaleway) succeeded: 8 to add, 0 to change, 0 to destroy