feat: support OpenTofu job containers

[xnoto]

Summary

Linear: No ticket — the cluster running arc-tf is down currently and it should never have been switched to those runners.

Allow reusable OpenTofu jobs to run in an optional caller-supplied container.

Implementation Details

• Add an optional container-image input.
• Apply it to test, plan, and apply jobs only when provided.
• Preserve ARC behavior for callers that omit the input.

Testing

• Parsed .github/workflows/opentofu.yml as YAML.
• Ran git diff --check.
• GitHub Actions CI pending.

Rollback and operational impact

• Omit container-image or revert this change to return jobs to their runner-native environment.
• No infrastructure resources change.

Completion Status

• Fully addresses the verified requirements

[github-actions]

Shared workflows CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed