fix(iam): allow seahaven-site HCP roles to read GitHub OIDC provider

Plan refresh needs iam:GetOpenIDConnectProvider for the content-deploy
role trust data source (PLAT-91 first-plan AccessDenied).

lib/terraform-substrate/terraform-substrate.template.yaml

@@ -1448,6 +1448,12 @@ Resources:
                   - iam:ListRoleTags
                 Resource:
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/githubdeploy-seahaven-site"
+              - Sid: RefreshGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: RefreshManagedPolicies
                 Effect: Allow
                 Action:
@@ -1507,6 +1513,12 @@ Resources:
                 Resource:
                   - arn:aws:s3:::seahaven-site-prod
                   - arn:aws:s3:::seahaven-site-prod/*
+              - Sid: ReadGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: CloudFrontManage
                 Effect: Allow
                 Action: