feat(terraform): default every stack to one Terraform version [NOJIRA]

[tobias0106]

Monta runs three Terraform versions today:

version	where
1.5.7	terraform — Cloudflare, Grafana
1.9.8	terraform-core — all 11 stacks
1.13.5	terraform — both ClickHouse stacks; terraform-db-access — all 56

terraform-stack.yml had no opinion: it read .terraform-version and hard-failed if a repo carried none, so every repo had to restate the answer.

What changes

DEFAULT_VERSION: "1.13.5" becomes the last fallback. Resolution order is now:

1. the caller's terraform-version input
2. .terraform-version in the stack directory
3. .terraform-version at the repository root
4. the org default

So the common case is a repo with no version file at all, and a stack that must differ keeps its own .terraform-version — which tfenv and asdf read too, so a local plan matches CI. The resolved version and where it came from are now logged.

Why 1.13.5 and not 1.16.2

1.16.2 is current, but 1.13.5 is what 58 of Monta's 71 stacks already run in production. Aligning and upgrading are two different changes; this one is the alignment, and picking a version already proven here makes it a no-op for db-access and ClickHouse. Bumping the default to 1.16.x afterwards is then a one-line PR — which is the point of having a default at all.

This does not upgrade anything by itself

A repo picks up a new default only when it re-pins this workflow, so stacks still move one at a time. That matters because the first apply on a new version rewrites the state format and older Terraform cannot read it back — the upgrade is one-way per stack.

Rollout, each its own PR and each its own apply:

• terraform-db-access — nothing to do, already 1.13.5.
• monta-app/terraform (feat: add configurable repository name for v2 workflows #168) — keeps its per-stack files; delete the two ClickHouse ones when re-pinning, and drop the 1.5.7 pins as Cloudflare and Grafana are bumped.
• terraform-core — one root file at 1.9.8 covering 11 stacks; bump it per stack, or all at once if a plan on 1.13.5 comes back clean.

🤖 Generated with Claude Code

[tobias0106]

Closing — the default does not earn its place.

It was sold as one place to bump the version for all three repos, but callers pin a commit SHA, so a new default only reaches a repo when that repo re-pins. It delivered none of that centralisation while adding a third source of truth.

It also removed a useful hard-fail: a repo with no .terraform-version currently gets an actionable error, where the default would silently run 1.13.5 and stamp state with a version nobody in that repo chose. That stamp is one-way, so silent-and-wrong is the expensive direction.

The existing order — terraform-version input, stack file, root file, else fail — is correct as it stands. A root .terraform-version keeps the version in git next to the code and is read by tfenv and asdf, so local plans match CI. For an org-wide knob, the caller can pass terraform-version: ${{ vars.TERRAFORM_VERSION }}, which propagates immediately without re-pinning.