Make Docker Terraform initialization cache-aware

[Ianyliu]

Summary

• add BLAST_RADIUS_TERRAFORM_INIT=auto|always|never with safe auto default
• skip auto-init for DOT-only mounts and non-empty .terraform/TF_DATA_DIR caches
• remove unconditional terraform get
• initialize uncached configurations with -backend=false -input=false
• resolve configuration/cache locations through relative or absolute CHDIR and TF_DATA_DIR
• fail invalid modes and missing CHDIR targets clearly
• document private-module reuse and Linux provider compatibility

Root Cause

The entrypoint always ran terraform get for an existing cache and then always ran terraform init. That defeated prepared private-module caches, required credentials/network access at every startup, and attempted initialization even for DOT-only visualization.

User Impact

Prepared projects can start without redownloading private modules. DOT-only containers no longer initialize Terraform. Operators can explicitly force or forbid initialization, while uncached configurations still initialize automatically without contacting a state backend.

Validation

• /tmp/blast-radius-plan-venv/bin/python -m pytest -q — 28 passed, 9 subtests passed
• POSIX shell syntax validation for both entrypoint scripts
• locally built blast-radius-fork:issue-19 with Terraform 1.15.8
• real read-only container tests: uncached init, cached private modules, DOT-only mount, nested CHDIR, invalid mode exit 64
• Node browser-state regression remains green
• workflow YAML validation and git diff --check main...HEAD

Compatibility

The default remains automatic initialization for uncached Terraform projects. Existing read-only/OverlayFS operation is preserved in this issue fix. Cached providers must match the container's Linux architecture; operators can select always when the host cache is incompatible or never when no Terraform command should run.

Fixes #19

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.