Add VCS module publish command

[AadarshIBM]

Description

Adds tfctl module publish for publishing VCS private registry modules from existing OAuth or GitHub App connections.

The command:

• Requires a repository and exactly one VCS connection ID.
• Uses tag-based publishing by default.
• Supports branch-based publishing with an optional initial version.
• Resolves the organization from the explicit flag, active profile, or Terraform configuration.
• Supports JSON, Markdown, dry-run, and quiet behavior.
• Uses tfctl's existing authenticated client because go-tfe/v2 does not yet provide a method for this endpoint.
• Returns immediately without polling and reports the API status verbatim.
• Restricts output and logs to safe module metadata.

For repositories that follow the standard terraform-<provider>-<name> naming convention, HCP Terraform automatically determines the module name and provider. Custom name/provider overrides and repositories requiring different VCS identifier and display-identifier values are outside this initial scope and can use tfctl api.

Validation completed:

• go test ./internal/commands/module ./internal/commands/root -count=1
• make gen/screenshot
• make bin
• make check
• go test ./... -race
• git diff --check

Example Output

Tag-based publishing dry run:

$ tfctl module publish \
    --repo acme/terraform-aws-network \
    --oauth-token-id ot-... \
    --organization acme \
    --dry-run

DRY RUN: would publish VCS-backed module from repository "acme/terraform-aws-network" to organization "acme" using tag-based publishing

Branch-based publishing:

$ tfctl module publish \
    --repo acme/terraform-aws-network \
    --github-app-installation-id ghain-... \
    --branch main \
    --initial-version 1.0.0

PR Checklist

• Prepared a changelog entry for the next set of release notes.
• Ensured the command is sensitive to these global flags:
  • --json — Forces machine-readable output to stdout.
  • --markdown — Forces Markdown output to stdout.
  • --dry-run — Resolves and validates the request without sending a mutation.
  • --quiet — Suppresses successful output and unessential guidance.
• Added safe debug logging using the logger from the command context.
• Regenerated the root command screenshot with make gen/screenshot.
• Reviewed autocomplete behavior. Repository, connection, branch, and version values do not have reliable local autocomplete, so autocomplete is not provided for them.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• Reverting this pull request fully removes the command. There are no migrations or persisted local state changes.
• This change does not modify security controls. Request bodies and VCS connection IDs are not included in command output or logs.