fix(terraform): bind stored plan identity (CTK-835)

[samuelho-dev]

Problem

Terraform apply verified object-store plans against a mutable checksum sidecar.

Why

A replaced archive and sidecar could preserve checksum validation while changing the plan applied.

Change

• expose the uploaded archive SHA-256 from terraform-plan
• require and verify that digest before extracting object-store plans
• retain sidecar compatibility and make archive and sidecar cleanup independent best-effort operations

Verification

• Pending deployment acceptance

References CTK-835

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 28e35e96-28c9-4e59-9f21-bc43606ed94d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}