fix: isolate OpenTofu plan comment capture

[xnoto]

Summary

Fix corrupted OpenTofu plan PR comments by giving the reusable workflow its own capture file. Consumer Makefiles continue to write plan-output.txt; the workflow now writes and reads plan-capture.txt, preventing concurrent truncating writers from producing sparse-file NUL holes.

The primary comment extraction now ends at the first Plan: summary, excluding the duplicate human-readable rendering emitted by tofu show. A tr -d '\000' stage removes malformed embedded NUL bytes before the existing ANSI stripping and sensitive-output redaction pipeline.

Validation

• Inspected the committed GitHub diff: only .github/workflows/opentofu.yml changed (7 additions, 6 deletions).
• Verified tfroot-github, tfroot-aws, tfroot-libvirt, and tfroot-cloudflare Makefiles each write plan-output.txt from tofu show.
• No local validation is available on this headless server; CI is the validation authority.

No consumer workflow references, markers, comment lifecycle, inputs, permissions, output cap, action pins, or redaction rules were changed.

[github-actions]

Shared workflows CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed