feat(terraform): add modular linux ci stack and network module

[lox]

Summary

• add a reusable infra/terraform/modules/network module for VPC, public/private subnets, IGW, NAT, and routing
• add a reusable infra/terraform/modules/linux-ci module for a private Linux CI host, IAM/SSM access, and bootstrap handoff script execution
• add infra/terraform/envs/ci as the composition root that wires modules/network and modules/linux-ci
• include ready-to-run terraform.tfvars/example values for the CI environment
• add Terraform to mise tool management in .mise.toml

Validation

• mise x -- terraform fmt -recursive infra/terraform
• mise x -- terraform -chdir=infra/terraform/envs/ci init -backend=false
• mise x -- terraform -chdir=infra/terraform/envs/ci validate

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 805ba7c46c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Point setup_script_path to an existing script

terraform.tfvars.example sets setup_script_path to scripts/bootstrap-linux-buildkite-agent.sh, but that script is not present in this repository (only scripts/install.sh exists), and the userdata bootstrap explicitly exits when the configured script path is missing. Because the README tells users to copy this example file, this causes a fresh CI environment to come up with a failed bootstrap on first boot.

Useful? React with 👍 / 👎.

[lox]

Fixed in f72dd91 and cc70ee7: the bootstrap path now points to an in-repo script (scripts/bootstrap-buildkite-agent.sh), and bootstrap was validated end-to-end on the Terraform host.