fix(stackit): add the moved blocks the landing zone refactor missed

modules/stackit/meshstack_integration.tf

@@ -395,6 +395,20 @@ resource "meshstack_building_block_definition" "this" {
   }
 }
 
+# --- State address migrations (no resource recreation) ---
+# Both resources gained `for_each = local.project_variants` when the `networked` project variant was
+# added. The `default` key holds what the single, unkeyed resource used to hold. Without these moves
+# a deployed integration destroys the landing zone its tenants are assigned to, and the `STACKIT
+# Project` definition that every tenant project building block instantiates.
+moved {
+  from = meshstack_landingzone.stackit_default
+  to   = meshstack_landingzone.this["default"]
+}
+moved {
+  from = meshstack_building_block_definition.this
+  to   = meshstack_building_block_definition.this["default"]
+}
+
 terraform {
   required_version = ">= 1.12.0"
 

reference-architectures/stackit-landingzone/buildingblock/main.tf

@@ -36,6 +36,17 @@ resource "stackit_resourcemanager_project" "foundation" {
   parent_container_id = var.stackit_org
 }
 
+# --- State address migration (no resource recreation) ---
+# The sandbox landing zone called this project `backplane`. Unifying the sandbox and hub-and-spoke
+# architectures renamed it to `foundation`, because it now holds more than the backplane service
+# account. Without this move a deployed landing zone destroys the project, and with it the
+# project-creation service account that every tenant project names as its owner.
+# `name` carries no RequiresReplace, so the `-backplane` -> `-foundation` rename updates in place.
+moved {
+  from = stackit_resourcemanager_project.backplane
+  to   = stackit_resourcemanager_project.foundation
+}
+
 module "stackit_integration" {
   source = "github.com/meshcloud/meshstack-hub//modules/stackit?ref=${var.hub.git_ref}"