Post-1175 cleanup: AWS OIDC, compose+proxy, OpenTofu rename, valkey

[filippo-20tab]

Summary

Multiple post-merge fixes and tooling refresh on top of #281 (the 1175 Minos integration).

Bootstrap workflow

• Honor BACKEND_TEMPLATE_URL_* / FRONTEND_TEMPLATE_URL_* env vars in init_subrepo so local bind-mounted sub-bootstrappers actually get cloned (was silently falling back to GitHub main).
• Propagate subrepo failures: init_subrepo now raises BootstrapError on git clone/pip install/sub-runner non-zero exit. cleanup() is no longer called on subrepo failure → dump preserved for retry.
• Rollback Talos own resources (TFC ws, GitLab group, Vault mount) on subrepo failure via try/except → reset_terraform.
• init_subrepo passes terraform_cloud_project_create=False so subs use the platform-created project as data source.

Provisioning hardening

• Bump Vault provider ~> 4.2.0 → ~> 5.0.
• var.secrets typed as any to accept heterogeneous payloads (platforms/{cluster}/... vs envs/{env}/...).
• TFC workspace creation serialized via TF_CLI_ARGS_apply: -parallelism=1 to avoid tfe_project readiness race that returned sporadic 422s.
• AWS OIDC: collector prompts aws_role_arn (and aws_region) when AWS is among chosen providers; runner registers AWS_ROLE_ARN/AWS_DEFAULT_REGION as GitLab group variables.
• Platform .gitlab-ci.yml CORE_PROVIDER matrix templated from cookiecutter.resources.core_providers (union of providers across clusters); AWS-specific id_tokens.GITLAB_OIDC_TOKEN and AWS_WEB_IDENTITY_TOKEN_FILE rendered only when AWS in providers.

Scaffolding

• Add platform-level compose.yaml, compose.local.yaml, proxy/config/{static,dynamic}.yaml, proxy/tls/{cert,key}.pem (self-signed, broad SANs from gs1-one).
• Replace Terraform binary with OpenTofu 1.10.6; rename terraform/ dir → tofu/ across the repo and runner.
• Exclude .terraform.lock.hcl, .terraform/, terraform.tfvars*, *.auto.tfvars* from Docker build context to prevent leaks.
• Bump base requirements (click, cookiecutter, etc).
• Rename redis references to valkey (CLI flags, env var names, GitLab group vars). Python redis package on the produced backend is intentionally retained because redis-py is protocol-compatible with Valkey.

Test plan

• python3 -m unittest tests.test_collector — 68/68 pass
• End-to-end run with sub-bootstrappers from local hotfix branch — completed without errors after the fixes above
• Smoke test of produced platform CI on a sandbox project (manual)