v2.1.1 — the plan block in local mode too

Patch on v2.1.0.
Same py-tirith (1.2.1), same verdicts, same inputs and outputs.

What was wrong

v2.1.0 put the planned changes in the comment — but only when policies come from StackGuardian. A
credential-free run showed findings with no sign of what was changing: the platform path is handed
the plan by the CLI itself, while local mode renders its own comment and passed no plan at all.

So the mode meant to be the easiest thing to try was the only one missing the feature that release was
named for.

The fix

Local mode now passes the masked document it had already written — the same file the policies are
evaluated against — guarded to the kinds that are masked, so an untouched passthrough document is
never handed to a renderer.

Verifying it, because there is a trap

render_plan_block has three outcomes:

input	output
no plan passed	nothing — no fence, no summary
a plan where nothing changes	the summary line only
a plan with changes	fence + summary

The summary line is what proves a plan was passed, not the fence. A run planning against
infrastructure that is already applied is a no-op, so the correct output there is
Plan: 0 to add, 0 to change, 0 to destroy. N unchanged. and no diff block. Looking for a fence in
that case and finding none looks exactly like the bug this release fixes.

Upgrading

- uses: StackGuardian/tirith-iac-governance-action@v2.1.1

v2 (py-tirith 1.2.0) and v2.1.0 are untouched. Each tag pins one CLI.

v2.1.0 — the plan diff in the comment

Installs py-tirith 1.2.1 (was 1.2.0).

The planned changes now render in the comment

Above the findings table, so a reviewer sees what is changing next to the rules that judged it:

```diff
+ aws_s3_bucket.analytics                          create
    + bucket = "analytics-not-a-demo-bucket"
    + tags = {"Demo":"...","Name":"...","Owner":""}
```
Plan: 1 to add, 0 to change, 0 to destroy. 2 unchanged.

Built from the masked plan document on your runner, never from terraform show output — masking is
the only thing keeping a value terraform marked sensitive out of a comment anyone with repository
access can read. Keys and values pass a fence guard, so a value of ``` cannot close the block.
Unchanged resources are counted rather than listed, and the block is dropped first if the comment
exceeds its size limit, because the findings are the point and the plan is context.

This applies in both modes, since the diff is rendered locally from the plan you supplied.

Richer result messages — local mode only

before:  `""` is empty
after:   [aws_s3_bucket.artifacts (no-op)] tags.Owner: `""` is empty

Platform findings are unchanged. They are produced by StackGuardian's evaluation step, which pins
its own CLI, so moving this action's pin cannot alter their text. They gain the wording when that step
image is rebuilt and its revision re-registered.

Also in 1.2.1: a resource skipped through error_tolerance no longer erases the verdict of resources
evaluated before it.

Upgrading

Nothing to change but the ref. Verdicts, exit codes, inputs and outputs are identical.

- uses: StackGuardian/tirith-iac-governance-action@v2.1.0

v2 is untouched and still installs 1.2.0. Each tag pins one CLI, so nothing moves under a
pipeline that did not ask for it — pin @v2.1.0 when you want this.

v2

What's Changed

• [SG-4885] feat: the Tirith IaC Governance action — zero-config, with a credential-free local mode by @refeed in #182

Full Changelog: v1.0.0-beta...v2

v1.0.0-beta

What's Changed

• fix docs by @Akshat0694 in #179
• better example by @Akshat0694 in #180

Full Changelog: v0.0.4-alpha...v1.0.0-beta

v0.0.4-alpha

refactor

v0.0.3-alpha

refactor

v0.0.2-alpha

refactor

v0.0.1-alpha

Merge pull request #6 from StackGuardian/release/test_01

Testing PR (don't merge)