feat(opentofu): source docs GitHub App key from Actions secret

[xnoto]

Summary

• add optional CHART_UPDATER_GITHUB_APP_PRIVATE_KEY to the reusable OpenTofu workflow secret contract
• source the generated-docs GitHub App key from that caller-mapped Actions secret instead of AWS OIDC + Secrets Manager
• remove the github-actions-opentofu-docs credential and Secrets Manager steps from the test job; id-token: write is no longer needed there (plan/apply keep OIDC for SOPS KMS)
• fail with a clear message when same-repository PR docs drift occurs without the App key, wired into the existing validation report
• keep fork PRs uncredentialed; forks never receive secrets and still fail on docs drift

Context

Completes the migration started by tfroot-github#42 and tfroot-aws#30: the chart updater App key is canonically SOPS-backed in tfroot-github and distributed as a repository Actions secret (charts already consumes it this way). The AWS Secrets Manager copy is legacy per tfroot-github/docs/chart-updater-github-app.md; this removes the last workflow reference to it.

Caller impact

• Callers passing CHART_UPDATER_GITHUB_APP_PRIVATE_KEY keep automatic App-authored docs commits, which retrigger PR validation on the resulting SHA.
• Callers without the mapping fail test with an explicit message when README.md is out of date, matching the pre-autofix behavior.
• Companion caller PRs add the mapping for tfroot-aws, tfroot-cloudflare, tfroot-gcp, tfroot-github, and tfroot-libvirt; they must merge after this PR so the secret input exists.

Validation

• GitHub Actions checks on this pull request are the validation authority.
• Reviewed the diff: no credentials, decrypted values, or state material included.

No merge or workflow dispatch performed.

[github-actions]

Shared workflows CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed