chore(infra): validate terraform stacks on pull requests

run fmt-check, init -backend=false, and validate for gcp/aws/az/oci
on prs touching apps/infra; no cloud credentials required

Co-Authored-By: First Fluke <our.first.fluke@gmail.com>

Author: gracefullight

.github/workflows/terraform-ci.yml

@@ -0,0 +1,48 @@
+name: Terraform CI
+
+on:
+  pull_request:
+    paths:
+      - "apps/infra/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-ci-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate (${{ matrix.stack }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        stack: [gcp, aws, az, oci]
+
+    defaults:
+      run:
+        working-directory: apps/infra/${{ matrix.stack }}
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform fmt check
+        run: terraform fmt -check -recursive
+
+      - name: Terraform init
+        run: terraform init -backend=false
+
+      - name: Terraform validate
+        run: terraform validate
+
+      - name: Write job summary
+        if: always()
+        run: |
+          echo "| Stack | Step | Result |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| ${{ matrix.stack }} | fmt / init / validate | ${{ job.status }} |" >> $GITHUB_STEP_SUMMARY