🤖 ci: gate publish-main on terraform checks

Require the terraform CI job for publish-main so GHCR image publishes on
main are blocked whenever Terraform validation/scanning fails.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$0.27`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=0.27 -->

Author: ThomasK33

.github/workflows/ci.yaml

@@ -318,7 +318,7 @@ jobs:
 
   publish-main:
     name: Publish GHCR :main
-    needs: [changes, test, lint, lint-actions, e2e-kind]
+    needs: [changes, test, lint, lint-actions, e2e-kind, terraform]
     if: |
       always() &&
       github.event_name == 'push' &&
@@ -327,7 +327,8 @@ jobs:
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
       (needs.lint.result == 'success' || needs.lint.result == 'skipped') &&
       (needs.lint-actions.result == 'success' || needs.lint-actions.result == 'skipped') &&
-      (needs.e2e-kind.result == 'success' || needs.e2e-kind.result == 'skipped')
+      (needs.e2e-kind.result == 'success' || needs.e2e-kind.result == 'skipped') &&
+      (needs.terraform.result == 'success' || needs.terraform.result == 'skipped')
     runs-on: depot-ubuntu-24.04-8
     timeout-minutes: 30
     permissions: