build(terraform): record linux and darwin provider hashes in every lock file, init env roots with -lockfile=readonly

.github/workflows/ci.yml

@@ -1062,19 +1062,20 @@ jobs:
           fi
 
       - name: Test CI/CD trust (immutable ids)
-        # Skips a cloud until it has a tests dir. The lock file is gitignored,
-        # so no -lockfile=readonly.
+        # Skips a cloud until it has a tests dir.
         run: |
           d="terraform/environments/$CLOUD/ci-cd-permissions"
           if [ -d "$d/tests" ]; then
-            terraform -chdir="$d" init -backend=false -input=false
+            terraform -chdir="$d" init -backend=false -lockfile=readonly -input=false
             terraform -chdir="$d" test
           fi
 
+      # -lockfile=readonly fails the job when a committed lock file lacks this
+      # runner's provider hashes, instead of quietly adding them (#1435).
       - name: Terraform Init
         run: |
           cd "terraform/environments/$CLOUD"
-          terraform init -backend=false
+          terraform init -backend=false -lockfile=readonly -input=false
 
       - name: Terraform Validate
         run: |