Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.