feat: require Twilio OpenTofu checks

## Summary

Graduate `tfroot-twilio` from its initial relaxed branch-protection
profile now that its OpenTofu workflow and centrally managed Dependabot
files are installed and reconciled.

Require the established `opentofu / test` and `opentofu / plan` checks
for `main`. A `moved` block preserves the existing protected-branch
state while changing profiles, avoiding a delete/recreate transition.

Fixes # N/A — complete the Twilio-root bootstrap governance gate.

## Type of change

- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
- [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS
secrets)
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change

## Validation

- [x] Required pull-request checks pass — OpenTofu test and plan
succeeded in [run
33838857603](https://github.com/makeitworkcloud/tfroot-github/actions/runs/33838857603).
- [x] Plan updates exactly one existing branch-protection resource: `0
to add, 1 to change, 0 to destroy`.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — no generated files are changed.

The required check names are verified against [`tfroot-twilio`'s caller
workflow](https://github.com/makeitworkcloud/tfroot-twilio/blob/main/.github/workflows/opentofu.yml)
and its completed validation run. No local OpenTofu, SOPS, state,
import, plan, or apply operations were run.

## Impact and rollout

Producer: `tfroot-github` owns branch protection. Consumer:
`tfroot-twilio` will require successful `opentofu / test` and `opentofu
/ plan` before future pull requests merge.

This PR neither changes the Twilio root's workflow nor configures
provider credentials, backend state, phone numbers, webhooks, bridge
deployment, routes, or runtime secrets. Its plan uses the moved address
to update the existing protection in place, adding the two required
checks and conversation resolution without a protection gap. After
confirmed merge, verify the environment-gated apply succeeds and that
the required contexts match the caller's emitted check names.

Rollback is a reviewed revert restoring the relaxed profile. The `moved`
block prevents a protection gap during this transition.

## Safety and secrets

- [x] Contains no plaintext secrets, decrypted SOPS values, state files,
kubeconfigs, tokens, or private endpoints.
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.

Repository-side secret scanning is unavailable because GitHub Advanced
Security is not enabled; the branch diff was manually inspected before
publication.

AI agent materially produced this change; reviewers should confirm no
secret-map, repository-topic, or unrelated protection change is present;
the moved protection address; and the exact required check names.

Author: xnoto

main.tf

@@ -53,11 +53,10 @@ locals {
     "tfroot-twilio"            = ["opentofu", "s3-backend", "sms", "sops", "tfstate", "twilio"]
     "www"                      = ["cloudflare", "css", "html", "pwa", "s3", "static-site"]
   }
-  # tfroot-twilio starts with the narrow relaxed profile so its initial PR can
-  # install the OpenTofu workflow before normal required checks are enforced.
+  # Public repositories remain on the relaxed profile only until their initial
+  # pull request has installed the required workflow and centrally managed files.
   relaxed_branch_protection_github_repositories = toset([
-    "agent-knowledge",
-    "tfroot-twilio"
+    "agent-knowledge"
   ])
   # Repositories where automation-created pull requests merge themselves once
   # required checks pass. GitHub auto-merge is enabled only for these
@@ -85,6 +84,7 @@ locals {
     "tfroot-github"            = ["opentofu / test", "opentofu / plan"]
     "tfroot-libvirt"           = ["opentofu / test", "opentofu / plan"]
     "tfroot-namecheap"         = ["opentofu / test", "opentofu / plan"]
+    "tfroot-twilio"            = ["opentofu / test", "opentofu / plan"]
     "www"                      = ["static-checks"]
   }
   secrets = {

moves.tf

@@ -0,0 +1,6 @@
+# Graduate tfroot-twilio from the temporary relaxed profile without deleting
+# and recreating its protected main branch.
+moved {
+  from = github_branch_protection.relaxed_protections["tfroot-twilio"]
+  to   = github_branch_protection.protections["tfroot-twilio"]
+}