Fix GitHub framework audit drift

[NWarila]

Summary

• Pin TFLint and align workflow tool settings with Terraform 1.15.4 and zizmor 1.25.2 pedantic audit mode.
• Restore complete provider lock metadata and update the Scorecard action ref to the commit behind v2.4.3.
• Correct ADR scope documentation and add F07 coverage for custom environment branch policies.

Verification

• Terraform fmt, validate, and test: 55 passed, 0 failed.
• TFLint 0.62.0, terraform-docs 0.23.0, actionlint 1.7.12, markdownlint, docs layout, and OPA policy check passed.
• zizmor 1.25.2 with pedantic persona reported no findings.
• Local org baseline simulation: 12 match, 0 drift, 0 missing.
• Workflow commit pins resolved through GitHub.