[EPAC-2070]: cleanup terraform state artifacts

[riddim-developer-bot]

Why

Terraform local state files were already removed as part of remote-state migration, but the repository still needed explicit hygiene: enforce ignore rules for generated state/plan artifacts and document the operator path after the migration.

What changed

• Updated infra/terraform/README.md with the post-migration operator workflow:
  • state storage and backend reference (A1 bootstrap script + A2 backend declarations)
  • local run path: aws sso login -> bash infra/terraform/bootstrap.sh <env> -> cd infra/terraform/<env> && terraform init && terraform plan
  • fresh-account path and note that bootstrap/migration is one-time operational setup
  • link to migration PR evidence: EPAC-2060
• Updated root .gitignore to ensure Terraform state and plan artifacts are ignored.
• Confirmed .terraform.lock.hcl is not ignored so provider lockfiles can stay committed.

Acceptance criteria

• �[32mOK�[0m infra/terraform/staging/terraform.tfstate deleted if present in git (already absent in this branch at issue time).
• �[32mOK�[0m infra/terraform/staging/terraform.tfstate.backup deleted if present in git (already absent).
• �[32mOK�[0m production/core local state globs similarly absent in git.
• �[32mOK�[0m .gitignore excludes *.tfstate, *.tfstate.backup, *.tfvars, *.tfplan, .terraform/.
• �[32mOK�[0m .terraform.lock.hcl remains tracked when present (pattern removed).
• �[32mOK�[0m infra/terraform/README.md now documents remote state path, local run commands, fresh-account operator flow, and migration evidence link.

Verification

• git diff --stat origin/main...HEAD shows only .gitignore and infra/terraform/README.md changed.
• gh pr create performed after rebase + push (branch is clean and rebased).

Skipped checks

• No Terraform runtime commands were executed in this PR (no functional verification requested by ticket).

Resolves EPAC-2070

Reviewer-Boundary: review-only