ci(reusable): make plan_only use local backend

[NWarila]

DO NOT MERGE until GS-03a audit is complete.

Summary

• Replace the plan_only terraform init -backend=false path with an ephemeral local backend rewrite followed by normal terraform init.
• Keep the S3 backend init and apply steps guarded behind !inputs.plan_only.
• Leave import-adoption enabled so the dry-run can produce a faithful reconciliation plan against local state.

Validation

• git diff --check
• terraform fmt -check -recursive terraform
• Runner PR feat(ci): graduate to mode: full #32 will temporarily pin this workflow commit to prove the plan_only dry-run end to end.