Terraform formatting CI runners

Terraform Fmt Check uses GitHub-hosted ubuntu-latest by default. Set repository variable CI_RUNNER_MODE=proxmox to select [self-hosted, linux, x64, proxmox, thb2] for pushes, manual dispatches, and same-repository PRs. Fork PRs and merge-queue runs always use hosted runners. Each job summary records its runner and requested labels.

gh variable set CI_RUNNER_MODE --repo thehelperbees/infrahive --body proxmox
gh workflow run terraform-fmt.yml --repo thehelperbees/infrahive --ref plan -f force_check=true

To switch back to GitHub-hosted runners later:

gh variable set CI_RUNNER_MODE --repo thehelperbees/infrahive --body github
gh workflow run terraform-fmt.yml --repo thehelperbees/infrahive --ref plan -f force_check=true

Start a fresh run after changing the variable; existing runs retain their assigned runners. The default branch gains this switch after the CI PR merges. The optional force_check input executes both checks regardless of path filters; changing the formatter workflow also exercises them automatically.

Both modes retain the project’s checksum-verified Zig toolchain, formatting target, and provider-manifest check. Proxmox uses two Zig build workers and a runner-specific local global-cache directory; hosted Actions caching is preserved. Existing main CI and operational workflows retain their current runner policies.

Same-repository PR code executes on persistent Proxmox machines before merge approval, trusting repository write access. Fork-hosted routing and read-only tokens do not provide per-job VM isolation. Owners must review that boundary before merge.