Add read-only ETag-stripped detector mode

[NWarila]

Scope

This ships the framework capability only and enables nothing until the separate caller pieces F1a and R1b land with the merged framework SHA. No caller repository is changed by this PR.

Owner/IAM precondition

Before either caller enables detector mode, the owner/IAM work must be completed. The organization planner role currently trusts only pull_request subjects, while schedule, push, and dispatch runs use the main-ref subject. The personal runner currently has no AWS_PLAN_ROLE_TO_ASSUME secret. Until this precondition is satisfied, a detector run would fail at OIDC role assumption.

Each caller needs its own aws_plan_role_arn passed as AWS_PLAN_ROLE_TO_ASSUME, with trust for both its PR and actual main-ref subject forms, pinned by repository identity and job_workflow_ref. Its permissions are read-only: exact-state-key s3:GetObject, prefix-scoped s3:ListBucket plus s3:GetObject for private definitions, and kms:Decrypt only if the object uses a customer-managed key; no S3 write action and no writer-role fallback.

Spike-derived facts

• Assertions key on the 304/200 response, never on the If-None-Match request header. Provider config.go:60-62 wraps logging outside the ETag transport, so TF_LOG=DEBUG contains zero occurrences of that header even when affected reads return 304.
• Stripping ETags is action-neutral but not drift-neutral: resource_changes[] actions and the human Plan: summary are identical before and after, while every affected address gains an ETag-only resource_drift[] entry on every stripped run. Issue existence and closure therefore remain keyed only to actionable resource_changes[]; the reporter does not parse resource_drift[].

Acceptance

• actionlint .github/workflows/reusable-terraform-deploy.yaml
• make ci with Terraform 1.15.4 on PATH: 93 Terraform tests, 14 detector-mode tests, and 12 destroy-guard tests passed.

🤖 Generated with Claude Code