feat: select remote state backend

[xnoto]

Summary

Select the applied tfroot-aws Twilio state backend: configure the S3 backend with native locking, route CI through the dedicated github-actions-twilio-state OIDC role, and retain the no-provider/no-resource boundary.

Fixes # N/A — validates the consumer half of the encrypted backend prerequisite before any Twilio credential, provider, phone-number, or webhook work.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed. The plan successfully initialized the dedicated backend under the scoped OIDC role and reported No changes.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated or centrally managed file is changed.

No local OpenTofu, Makefile, SOPS, state, import, plan, or apply operation was run. GitHub Advanced Security secret scanning is unavailable; the narrow diff was manually inspected and contains no credentials, decrypted values, tokens, state, or sensitive plan output.

Impact and rollout

Producer: tfroot-aws PR #43 merged at 5faa314d, and its main apply succeeded. It owns the dedicated private/versioned/encrypted state bucket and exact-repository OIDC role.

Consumer: this root uses the existing shared-workflows aws-role-to-assume input; no shared-workflow contract changes. Its Makefile selects S3 native locking and removes the bootstrap -backend=false / -lock=false behavior. The PR deliberately leaves the Twilio provider unconfigured and adds no encrypted file, provider credential, resource, phone number, webhook, bridge credential, runtime map, allowlist, GitOps workload, Cloudflare route, or public endpoint.

A confirmed merge submits the environment-gated main apply, which initializes the remote backend under the dedicated role. That is state-backend selection only, not Twilio provider activity. Rollback is a reviewed revert to backend-free initialization; the producer bucket is intentionally retained and protected by prevent_destroy.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI agent materially produced this change; reviewers should confirm the exact OIDC-role input, native S3 locking, no static AWS credential path, and retained absence of any Twilio provider configuration or resource.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and