fix(tf): phase 2b — bug-fix pass (B1–B13) + -race on

[grubmeshi]

Phase 2b — tf runner bug-fix pass

Executes the phase-1 bug inventory (PLAN_DETAIL_02 §7, R1–R13): one flip per bug, nothing else. Every phase-1 characterization assertion that pinned buggy behavior is retargeted to assert the corrected behavior; no other behavior changes.

Bug fixes (R1–R13)

• R1 B6/B10 — -race on (Taskfile test:tf-block-runner + CI tf leg); the two functional-only race pins dropped (races were structurally eliminated in phase 2).
• R2 B1 — selectWorkspace propagates the WorkspaceSelect error (no silent state-split).
• R3 B2 — return the real matched workspace name; DESTROY now deletes the actual workspace.
• R4 B3 — deleteWorkspaceIfNeeded returns after a select error.
• R5 B4 — plainInit retry sleeps time.Second, not 1000 ns.
• R6 B5 — decryptIfSensitive decrypts every sensitive value regardless of DataType.
• R7 B7 — NewLogWrap/initRunContextInfo return (x, error), wired into sendInitFail.
• R8 B12 — Behavior.str() returns "UNKNOWN" instead of log.Fatalf.
• R9 B13 — APPLY prints HINT_INIT_FAILED on init failure like DETECT/DESTROY.
• R10 B9 — gitsource nil-safe *g.path in the missing-sourceDir log (+ regression test).
• R11 B8 — installTofuBinaries honors the caller's ctx.
• R12 B11 — single-run exits non-zero only for pre-flight failures (workdir setup / run-JSON parse / registration, before tofu init/apply); stays exit-0 once a run has begun.
• R13 cleanup — removed the behavioral tfrun/main.go golangci-lint exclusion blocks and fixed every surfaced finding; grep -c "FIXME(bug)" = 0.

Sanctioned deltas (PLAN_DETAIL_02 §8; hand-off notes in CROSS_REPO_TODO.md)

• B2 — workspace-delete naming (D9-pinned): DESTROY now deletes the real matched workspace instead of a bare buildingBlockId that never existed on disk. Previously-orphaned local-dev workspaces will now actually be removed. Awareness note for meshfed-release maintainers.
• B5 — sensitive non-string-like inputs now decrypted (customer-visible): sensitive BOOLEAN/INTEGER/SINGLE_SELECT/MULTI_SELECT/LIST inputs previously passed ciphertext through; they are now decrypted. Release-notes call-out.
• B11 — single-run exit semantics (adjacent to the frozen k8s Job contract): scoped non-zero exit avoids the BackoffLimit:1 + RestartPolicy:Never double-execution hazard — only pre-terraform failures exit non-zero; a failed terminal PATCH on an already-applying run stays exit-0.

Gates

• task test:tf-block-runner (-race): PASS
• task lint: 0 issues (all three modules)
• task coverage: tfrun 90.4% ≥ 90% (monotonic vs phase-2's 90.3%)

Phase-2b exit criteria met: bug inventory empty, no FIXME(bug) markers, -race on.

Note for reviewers

The base branch (phase-2-tf-ddd-refactor) is the partial phase-2 (commit "phase 2, partial"): the DDD refactor to internal/{tf,gitsource,tofu} + Engine/ports + de-globaling AppConfig and collapsing Worker/SingleRunWorker/TfCmd is not yet done on this base. This PR applies the 2b bug inventory on the still-tfrun-shaped code. That gap is a phase-2 completion item and will trip PLAN_DETAIL_03's STOP-A (A2/A3/A4/A10) until phase 2 is finished — flagged, out of scope for this bug-fix pass.

🤖 Generated with Claude Code

[grubmeshi]

Superseded by #65, which consolidates the plan + all phases 0→7 + the phase-3/5 remediation into a single reviewable PR (with all plan/run artifacts and a code-verified FOLLOW_UP.md). Closing in favor of #65.