Harden template pipeline automation

[samir-gandhi]

Summary

• Harden branch-triggered deploy and feature cleanup workflows.
• Pin CI dependencies; install Terraform before all Terraform commands.
• Fix Trivy Make target, lock provider versions, ignore runtime artifacts, and add contract tests.
• Tighten internal PR workflow and temporary secret handling.

Validation

• tests/test_pipeline_contract.sh
• make -n devcheck
• terraform fmt -recursive -check terraform
• terraform validate (existing DaVinci deprecation warnings)
• tflint --recursive
• trivy config terraform (0 findings)
• YAML and shell syntax checks

Compatibility

• Push auto-apply retained for branch pushes.
• Original prod branch unchanged until merge.

🤖 Generated with Claude Code