feat: Bootstrap GitHub Repos IaC: module, repo configs, and parallel plan/apply CI

[lukebrady]

Summary

• Introduces OpenTofu/Terraform to manage GitHub repositories from this repo.
• Adds a reusable repository module, initial repo configs, and a CI pipeline that detects changes and plans/
  applies per-repo in parallel.

Changes

• modules/repository: repository resource with common options (merge strategies, wiki/projects,
  default_branch), team permissions, and issue labels.
• repositories/ai-engineering: config + README and tfvars example for importing existing repo.
• repositories/repositories: bootstrap config for this repo (auto_init=false to avoid push conflicts).
• .github/workflows/repositories.yml: change detection (git diff), matrix per changed repo, tofu init/fmt/
  validate/plan on PRs; apply on main. Exports AWS creds from secrets.
• AGENTS.md: concise contributor guide tailored for OpenTofu/Terraform.
• .gitignore: ignores state, providers, plans, and local overrides.

How It Works

• On PRs touching modules/** or repositories/**, CI builds a matrix of changed repos and runs tofu plan
  in parallel.
• On main pushes, CI applies only the changed repos. Includes per-repo concurrency to avoid overlaps.
• Uses GH_ADMIN_TOKEN for GitHub provider; exports AWS_ACCESS_KEY_ID/SECRET (and region) for S3/DynamoDB
  backends.

Prerequisites

• Actions secrets: GH_ADMIN_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or
  AWS_DEFAULT_REGION).
• S3/DynamoDB backend configured (already in place).