ci(runners): add terraform test for pool module type safety

[Brend-Smits]

Problem

terraform validate cannot detect conditional type mismatches like the one introduced in #4875:

role = var.iam_overrides["override_runner_role"] ? { arn = var.iam_overrides["runner_role_arn"] } : aws_iam_role.runner[0]

This passes terraform validate but fails at plan time because the two branches produce objects with different attributes (1 vs 16).

Solution

Add a terraform test file (modules/runners/tests/pool.tftest.hcl) that uses mock providers to run a full plan of the runners module with pool enabled. This catches type errors that validate misses, without requiring AWS credentials.

Also adds a terraform_test job to the existing CI workflow. The job uses Terraform latest (requires 1.7+ for mock_provider / mock_data support) and runs terraform test on modules that have test files.

Verified locally

With the buggy code (before #5156):

Error: Inconsistent conditional result types
  on pool.tf line 54, in module "pool":
  The true and false result expressions must have consistent types.

With the fix (#5156 applied):

Success! 1 passed, 0 failed.

Future work

The terraform_test job matrix can be expanded as more modules add .tftest.hcl files. This is a starting point to catch the class of bugs that validate cannot.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None