ci(reusable): gate terraform apply behind explicit input

[NWarila]

DO NOT MERGE until the GS-03c audit confirms the apply gate and workflow checks are clean.

Summary

• Add a workflow_call boolean apply input that defaults to false.
• Keep the existing plan_only local-backend dry-run path intact.
• Keep the real-state init/import/validate/plan/upload path intact for non-plan_only runs, but require inputs.apply && !inputs.plan_only before terraform apply can run.

Validation

• Parsed .github/workflows/reusable-terraform-deploy.yaml with PyYAML.
• Verified the signed commit metadata with git log --show-signature.
• Triggered no Terraform apply and no apply=true dispatch.