* refactor(iam): forget in-repo HCP exec roles
Org-baseline owns the apply and plan roles, so this workspace can assume them without a bootstrap window. Prod state forgets the old addresses without destroying the live roles.
* ci(terraform): pin the isolation check to v1.0.21
The pre-release pin cloned the private .github repo with the caller token and the Terraform job failed. v1.0.21 loads the checker from the workflow commit.
