fix: report captured OpenTofu plan failures

[xnoto]

Summary

• capture make plan stdout and stderr even when the Makefile does not create plan-output.txt
• retain the actual plan exit code through the capture pipeline
• redact potentially sensitive plan lines and escape Markdown code fences before updating the sticky plan comment

Validation

• CI is authoritative: awaiting the repository lint check.

Impact

• Reusable OpenTofu plan comments become actionable for failed plans across caller roots without publishing known-sensitive output.

[github-actions]

Shared workflows CI passed

Pre-commit validation passed. View the workflow run.