* feat(iam): import hcptf roles into app Terraform (PLAT-146)
Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.
* fix(iam): add apply-role IAM list permissions (PLAT-146)
IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
* feat(terraform): add hcp terraform for prod door-unlock-api
Move deploy off frozen CDK CD onto an HCP workspace that recreates the HTTP API, five Lambdas, disabled EventBridge rules, and alarms in seahaven-prod without a poller VPC.
* docs(readme): link the door unlock api ops page
* fix(terraform): invoke package build via bash
HCP launches the external data source with bash, so the inner build script should not depend on the git executable bit.
