chore(ci): pin framework to the inventory completeness check

[NWarila]

Summary

• Moves all four reusable-framework pins from 5b4cc46d703381d76ffbcecbb282d1302a9fbf27 to 73b86e869fe4e1c61dd1e83ebc52d6adbc50f33f and updates the detector comments.
• #100 adds a CI-only template-drift gate; it does not change managed resources.
• #101 renames the Terraform files; this is a semantic no-op.
• #102 adds an inventory-completeness check and organization-detector-only classification; it adds no resource, variable, or output.

Apply and inventory behavior

Merging this PR runs a real terraform apply because the workflow runs apply on a push to main. No resource change is expected: #100 is CI-only, #101 only renames Terraform files, and #102 adds searches, an advisory check, and detector-only classification without changing resource configuration. The PR-head resource plan must nevertheless be reviewed before merge.

Live inventory results first become observable in the post-merge detector. If it reports INVENTORY / enumeration-unverified, that is the fail-closed token-permission/secret-readiness case: hand it to the owner rather than changing the framework.

Merge ordering

#71 must merge before #72. After #71 merges, update #72 onto the resulting current main, resolve the shared required_checks overlap while retaining both of #72's required-check entries, and require a fresh successful PR-head deploy plan and all checks at that updated head. F3a can be serialized before #71, between #71 and #72, or after #72; after any preceding merge, update every remaining candidate onto current main and require a fresh PR-head plan.

Rollback

Revert this change as one unit so all four literals return to 5b4cc46d703381d76ffbcecbb282d1302a9fbf27 and both comments are restored together. This stops inventory reporting; close any open inventory-only issue by hand. It does not undo applied changes, and none are expected.

Acceptance evidence

Items 1–3 transcripts

$ diff -u /home/hellbomb/wf-exchange/orders/f3a/terraform.yml.target .github/workflows/terraform.yml
<no output; exit 0>

$ git diff --stat origin/main
 .github/workflows/terraform.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

$ grep -c 73b86e869fe4e1c61dd1e83ebc52d6adbc50f33f .github/workflows/terraform.yml
4

$ grep -c 5b4cc46d703381d76ffbcecbb282d1302a9fbf27 .github/workflows/terraform.yml
0

$ actionlint -no-color .github/workflows/terraform.yml
<no output; exit 0>

PR-head run results (items 4–5)

Run: https://github.com/nwarila-platform/github-terraform-runner/actions/runs/35012737140

• Event: pull_request
• Head: 8e04c691f51e1823ea9dd8be5b7a9a0f2b587d9e
• deploy / Deploy: SUCCESS
• Sanitized credential line: Authenticated as assumedRoleId AROA3RQAW557VJBAJR2A6:GitHubActions

Sanitized Terraform resource-plan rows:

count	action
1	update

resource	action
github_repository_ruleset.branch["<redacted>"]	update

This is one actionable resource row, so the expected no-actionable-row result was not met. It is an owner review finding to hand off before merge; no implementation change, retry, or additional push was made. No check.inventory_complete warning is claimed from this PR-head log; live inventory classification first appears in the post-merge detector.

Checks summary: every check at the exact head is complete. deploy / Deploy is SUCCESS; post_apply_detector is SKIPPED as event-gated for pull_request; there are no failing or pending checks.