fix(deploy): fail closed on unknown-only plan attributes

Include after_unknown keys in the version-only diff so a computed-only allowlist cannot hide an unexamined environment mutation.

scripts/check-terraform-release-plan.py

@@ -185,7 +185,7 @@ def changed_attributes(change: dict[str, Any]) -> set[str]:
     before = change.get("before") or {}
     after = change.get("after") or {}
     unknown = change.get("after_unknown") or {}
-    keys = set(before) | set(after)
+    keys = set(before) | set(after) | set(unknown)
     changed: set[str] = set()
     for key in keys:
         unknown_value = unknown.get(key)

scripts/test-terraform-release-plan-check.py

@@ -254,6 +254,7 @@ def main() -> int:
         ("wrong-label", run_case("wrong-label.json"), 1),
         ("eb-setting-change", run_case("eb-setting-change.json"), 1),
         ("nested-unknown-tags", run_case("nested-unknown-tags.json"), 1),
+        ("unknown-only-description", run_case("unknown-only-description.json"), 1),
         ("iam-update", run_case("iam-update.json"), 1),
         ("dns-update", run_case("dns-update.json"), 1),
         ("create", run_case("create.json"), 1),

scripts/testdata/terraform-release-plans/unknown-only-description.json

@@ -0,0 +1,39 @@
+{
+  "resource_changes": [
+    {
+      "address": "module.environment.aws_elastic_beanstalk_environment.this",
+      "mode": "managed",
+      "type": "aws_elastic_beanstalk_environment",
+      "change": {
+        "actions": ["update"],
+        "before": {
+          "version_label": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-1-1",
+          "setting": [
+            {
+              "namespace": "aws:elasticbeanstalk:environment",
+              "name": "EnvironmentType",
+              "value": "LoadBalanced"
+            }
+          ],
+          "tags": { "env": "dev", "project": "shoc" }
+        },
+        "after": {
+          "version_label": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-2-1",
+          "setting": [
+            {
+              "namespace": "aws:elasticbeanstalk:environment",
+              "name": "EnvironmentType",
+              "value": "LoadBalanced"
+            }
+          ],
+          "tags": { "env": "dev", "project": "shoc" }
+        },
+        "after_unknown": {
+          "instances": true,
+          "load_balancers": true,
+          "description": true
+        }
+      }
+    }
+  ]
+}