Split the Terraform CI role: read-only plan credentials on pull requests, write apply credentials on main (tf-lint AVD-AWS-0345) #225

Item 2 of #180, accepted 2026-10-30 with this target posture: split, not per-resource least privilege. A read-only plan role for pull_request runs and a write apply role for pushes to main. Per-provider-resource permission diffs are not the goal.

Current state

• One role, solidago-dev-github-actions-terraform (modules/iam), is assumed by both the plan job (on pull_request) and the apply job (on push to main) in .github/workflows/terraform.yml, with <service>:* on ~20 services.
• modules/iam/main.tf already carries the intent in a comment ("separate roles for terraform plan (read-only) vs terraform apply (write)").

Shape

• New role …-github-actions-terraform-plan: trust restricted to this repo's pull_request subject; policy = ReadOnlyAccess-class permissions plus the writes a plan needs (state object read, lock-table item get/put/delete), enumerated from the backend config.
• The existing role keeps apply; its trust narrows to ref:refs/heads/main (plus workflow_dispatch if the workflow allows it).
• terraform.yml: the plan job assumes the plan role, the apply job the apply role.
• Bootstrap note in the README: the roles are themselves Terraform-managed, so the apply that creates the plan role runs under the existing role; order the PR so plan on the PR itself still succeeds before any trust narrows.
• The trivy:ignore:AVD-AWS-0345 stays unless the finding disappears on the apply role; its comment then points at this issue as the resolution (the split is the deliberate posture; s3:* on the apply role is by design).

Acceptance

• A PR plan runs under the plan role and succeeds; an apply attempted under it is denied.
• The apply on merge runs under the apply role and succeeds.
• aws sts get-caller-identity in each job log names the expected role.