[jaydreyer]

Summary

• keep the bootstrap root on Terraform’s implicit local backend until the state bucket exists
• provide an inactive S3 backend template and document the reviewed local-to-S3 state migration
• add mocked bootstrap security assertions and run them in CI

Root cause

The bootstrap root declared its S3 backend before the state bucket existed. terraform init -backend=false installed providers, but it did not activate an implicit local backend, so the following saved-plan command correctly refused to run.

Verification

• terraform fmt -check -recursive infra/terraform
• bootstrap terraform init, terraform validate, and terraform test
• recovery from the previously interrupted init -backend=false sequence
• demo terraform init -backend=false, terraform validate, and terraform test (5 passed)
• actionlint
• independent review: approved with no findings

No AWS apply, state migration, or resource mutation was performed.

Refs #45 and #49.