Add advisory required checks ruleset

[NWarila]

Summary

• Add the advisory_checks YAML key and a CI Status Advisory baseline ruleset in evaluate mode.
• Materialize that ruleset only when advisory_checks is non-empty.
• Keep the existing required_checks to Pull Request Gate active enforcement path unchanged.
• Add offline Terraform test coverage and ruleset documentation.

Validation

• C:\tmp\terraform-1.15.4\terraform.exe -chdir=terraform fmt -check -recursive -diff - pass
• C:\tmp\terraform-1.15.4\terraform.exe -chdir=terraform init -backend=false -reconfigure -input=false - pass
• C:\tmp\terraform-1.15.4\terraform.exe -chdir=terraform validate -no-color - pass with pre-existing provider deprecation warning on github_actions_environment_secret.plaintext_value
• C:\tmp\terraform-1.15.4\terraform.exe -chdir=terraform test -no-color - pass, 55 passed / 0 failed, with pre-existing provider deprecation warnings
• C:\tmp\tflint-0.62.0\tflint.exe --chdir=terraform - pass
• C:\tmp\terraform-docs-0.23.0\terraform-docs.exe --config .terraform-docs.yml --output-check terraform - pass
• python tools\check_docs_layout.py - pass

Notes

No apply was run. A real terraform plan was not run because this configuration still requires S3 backend initialization for plan; the offline materialization/no-op proof is covered by the mock-provider terraform test plan assertions.