Replace Terraform with OpenTofu as canonical IaC

[catinspace-au]

Swap Terraform -> OpenTofu everywhere; make OpenTofu the default/canonical IaC.

Why

• Licensing: Terraform is BSL; OpenTofu is MPL-2.0. DFE is going public as a
  product suite others deploy - we should not push HashiCorp's BSL onto our
  deployers or ourselves. This is an OSS-readiness item, not just tooling.
• Drop-in: HCL is identical; providers/modules and state are compatible; the
  .tf files themselves do not change.

Current state (this completes an existing workstream)

• dfe-infra already runs a dual TF/Tofu CI. versions.yaml notes "OpenTofu to
  be canonical; ln kept for dual-CI compat", and pins opentofu: 1.7.0.
• So this is "finish the flip", not a fresh migration.

Scope

• Flip the hyperi-ai IaC standard (standards/infrastructure/TERRAFORM.md +
  rules/ln.md) to OpenTofu-default.
• Make tofu the CI default; un-matrix the dual TF/Tofu; drop the Terraform side.
• Swap terraform CLI calls -> tofu in scripts/CI/Makefiles/docs
  (dfe-infra bootstrap/deploy.sh, bridge, etc.).
• Update docs + CLAUDE.md references.
• Bump the opentofu pin to a current version (per the cooldown/LTS rules);
  align local + CI via a version manager (tenv) so the state format never drifts.
• .tf files unchanged - verify the flip is a plan no-op.

Repos affected

dfe-infra (primary IaC), any other repo carrying Terraform, the hyperi-ai standards.

Watch-out

Pin ONE tofu version across local + CI (tenv). A newer tofu can upgrade the state
format on apply and break an older-pinned CI - the classic "works locally, breaks
CI" trap.