feat(opentofu): drop nested container, default to arc-tf native runner (#2)

## Summary

The arc-tf runner-set (kustomize-cluster #25) runs the tfroot-runner
image directly — no nested \`container:\` block required. Drop:

- the \`container:\` input
- the per-job \`container:\` blocks
- the \`cp -r /root/.ssh /github/home/\` step that only existed because
of the nested container's \`\$HOME=/github/home\` quirk

Default \`runs-on\` changes from \`ubuntu-latest\` to \`arc-tf\`.

## Pairs with

- images PR #6 (merged) — tfroot-runner rebased onto
\`ghcr.io/actions/actions-runner\`.
- kustomize-cluster #25 — \`arc-tf\` AutoscalingRunnerSet.
- tfroot-libvirt (incoming) — caller switches to \`runs-on: arc-tf\`.

## Backwards compatibility

This is a breaking change for any caller passing \`container:\` or
relying on the \`ubuntu-latest\` default. The only known caller is
\`tfroot-libvirt\`, which is being updated in a paired PR. Other
consumers (if any) need to drop their \`container:\` input and either
accept the \`arc-tf\` default or set \`runs-on: ubuntu-latest\`
explicitly.

## Test plan

- [ ] After merge + tfroot-libvirt update: \`tfroot-libvirt\` PR CI
passes against the \`arc-tf\` runner pod (no nested container, SOPS /
sops / tofu / pre-commit all resolve from the image's PATH)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: xnoto

.github/workflows/opentofu.yml

@@ -10,11 +10,7 @@ on:
       runs-on:
         description: Runner label
         type: string
-        default: ubuntu-latest
-      container:
-        description: Container image to use
-        type: string
-        default: ghcr.io/makeitworkcloud/tfroot-runner:latest
+        default: arc-tf
       setup-ssh:
         description: Whether to setup SSH keys
         type: boolean
@@ -35,8 +31,6 @@ jobs:
   test:
     name: Pre-commit Tests
     runs-on: ${{ inputs.runs-on }}
-    container:
-      image: ${{ inputs.container }}
     env:
       SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
     steps:
@@ -52,10 +46,6 @@ jobs:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
 
-      - name: Copy SSH area
-        if: ${{ inputs.setup-ssh }}
-        run: cp -r /root/.ssh /github/home/
-
       - name: Fetch canonical pre-commit config
         run: |
           curl -sSL -o .pre-commit-config.yaml \
@@ -70,8 +60,6 @@ jobs:
   plan:
     name: OpenTofu Plan
     runs-on: ${{ inputs.runs-on }}
-    container:
-      image: ${{ inputs.container }}
     if: github.event_name == 'pull_request'
     needs: [test]
     env:
@@ -87,10 +75,6 @@ jobs:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
 
-      - name: Copy SSH area
-        if: ${{ inputs.setup-ssh }}
-        run: cp -r /root/.ssh /github/home/
-
       - name: OpenTofu Plan
         id: plan
         run: |
@@ -125,8 +109,6 @@ jobs:
   apply:
     name: OpenTofu Apply
     runs-on: ${{ inputs.runs-on }}
-    container:
-      image: ${{ inputs.container }}
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: [test]
     environment: ${{ inputs.environment }}
@@ -143,9 +125,5 @@ jobs:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
 
-      - name: Copy SSH area
-        if: ${{ inputs.setup-ssh }}
-        run: cp -r /root/.ssh /github/home/
-
       - name: OpenTofu Apply
         run: make apply