feat: authenticate Twilio provider from SOPS

[xnoto]

Summary

Configures the pinned Twilio provider to consume its existing encrypted account credentials only through SOPS process-environment injection. The root still declares no Twilio resource.

Fixes # N/A — validates live provider authentication before any phone-number inventory or inbound webhook change.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed. The credentialed plan initialized the remote backend, completed the provider's default credential validation through SOPS exec-env, and reported No changes.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated or centrally distributed file changed.

No local OpenTofu, Makefile, SOPS, state, import, plan, or apply operation was run.

Impact and rollout

Producer: merged credential delivery at e325cba5 supplies the only permitted SOPS ciphertext. Consumer: this PR adds an empty twilio provider block and runs OpenTofu itself inside sops exec-env; credentials remain absent from provider configuration, source, runner files, and GitHub Actions secrets. The existing runner and reusable workflow contracts already supply SOPS, jq, and the exact-repository AWS KMS role.

The provider's default credential validation is enabled and passed during PR CI. No Twilio resource is declared, so neither stage can purchase a number, configure a webhook, alter messaging, or change the bridge. The documented pilot remains one future number per primary agent with an initially single, later-extensible sender allowlist owned by kustomize-cluster; this PR does not select or deploy it. Rollback is a reviewed revert to the prior no-provider state; encrypted ciphertext remains protected by the existing KMS recipient in Git history.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. No encrypted credential content was changed.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the changed source was manually reviewed. AI agent materially produced this change; reviewers should confirm SOPS process-scoped provider authentication, the retained no-resource boundary, and the absence of bridge/runtime ownership crossover.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and