chore(security): commit Terraform provider lockfiles and enforce in CI

[jordanconway]

Summary

Provider lockfiles (.terraform.lock.hcl) were explicitly gitignored via *.lock.hcl in terraform-aws-github-runner/.gitignore. This means every tofu init resolves provider versions live from the registry — a compromised or unexpected provider version (e.g. one matching the existing ~> 5.5 / ~> 3.4.2 loose constraints) could be silently installed with no diff ever appearing in this repo.

---

Changes

1. Un-ignore .terraform.lock.hcl in terraform-aws-github-runner/.gitignore

Removes the *.lock.hcl glob and replaces it with a comment explaining why the file must be tracked. The .tfstate and .terraform/ patterns are untouched.

2. Commit terraform-aws-github-runner/.terraform.lock.hcl

Generated with:

tofu init -backend=false
tofu providers lock \
  -platform=linux_amd64 -platform=linux_arm64 \
  -platform=darwin_arm64 -platform=darwin_amd64

Providers locked (all signed with key 0C0AF313E5FD9F80):

Provider	Version	Constraint
hashicorp/aws	5.100.0	~> 5.5
hashicorp/random	3.4.3	~> 3.4.2

3. Commit modules/download-lambda/.terraform.lock.hcl

This module is not called from the root module (it appears to be a standalone utility root module). It has its own required_providers for hashicorp/null and therefore needs its own lockfile.

Provider	Version	Constraint
hashicorp/null	3.2.4	~> 3.2.1

4. Add Verify lockfile integrity step to tflint.yml

Runs tofu init -backend=false -lockfile=readonly before linting. CI will now fail if the lockfile is missing, out of date, or inconsistent with the checked-in constraints — ensuring the lockfile is always kept current.

---

Keeping lockfiles up to date

After a provider version bump (from a Dependabot PR or manual update), re-run:

cd terraform-aws-github-runner
tofu providers lock \
  -platform=linux_amd64 -platform=linux_arm64 \
  -platform=darwin_arm64 -platform=darwin_amd64

Commit the updated .terraform.lock.hcl. The -lockfile=readonly CI step will then verify it matches.

---

⚠️ Note: the provider constraints (~> 5.5, ~> 3.4.2, ~> 3.2.1) are still loose ranges. A companion PR tightens these to exact = X.Y.Z pins, which is the stronger control. This PR and that one are independent and can be merged in either order.

This change is part of a broader supply-chain hardening effort following a repository audit. See https://github.com/jordanconway/package-manager-hardening for the full methodology.

[vercel]

@jordanconway is attempting to deploy a commit to the Meta Open Source Team on Vercel.

A member of the Team first needs to authorize it.