feat: Stacks Terragrunt support

[maciaszczykm]

Test Plan

Repository with samples: https://github.com/pluralsh/terragrunt-samples
Test environment: https://console.plrl-dev-aws.onplural.sh/
Test tag: pr-3631

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-4658

[greptile-apps]

Greptile Summary

This PR introduces end-to-end Terragrunt stack support across the console, deployment operator, and controller — adding the new TERRAGRUNT enum value, a dedicated TerragruntConfiguration type (parallelism, refresh, approveEmpty), a full Go Terragrunt tool implementation, a new harness Dockerfile, Elixir command generation, GraphQL schema changes, and frontend UI updates.

• Go harness: New terragrunt package mirrors the Terraform tool (State, Plan, Output, HasChanges, Modifier, ConfigureStateBackend), wired into the tool.New dispatcher and Trivy scanner. The harness Dockerfile correctly verifies the SHA256 checksum of the Terragrunt binary before install.
• Elixir backend: Adds terragrunt to the Stack.Type enum, an embedded Terragrunt configuration schema, and terragrunt_commands/2 that handles plan/apply/destroy flows (init is omitted intentionally — Terragrunt auto-initialises).
• Frontend: New stackTypeUtils.ts centralises type labelling and isTerraformFamilyStackType; StackConfiguration.tsx reads/writes from the correct configuration block depending on stack type.

Confidence Score: 5/5

Safe to merge; changes are well-scoped, tested, and consistent with the existing Terraform tool patterns.

The implementation is thorough and consistent across all layers. The Go Terragrunt tool faithfully mirrors the Terraform tool, Elixir command generation is correct and covered by tests, the Dockerfile includes checksum verification, and the frontend properly reads from and writes to the correct configuration block. The only notable concern is that ConfigureStateBackend writes an _override.tf file which will be silently ignored for Terragrunt stacks sourcing remote Terraform modules — but this is a usage-pattern constraint rather than a correctness bug in the code itself, and the author has verified the feature against a real test environment.

go/deployment-operator/pkg/harness/tool/terragrunt/terragrunt.go — the _override.tf HTTP backend approach has a documented constraint worth keeping in mind for future Terragrunt module patterns.

Important Files Changed

Filename	Overview
go/deployment-operator/pkg/harness/tool/terragrunt/terragrunt.go	New Terragrunt tool implementation — mirrors the Terraform tool (State, Plan, Output, Modifier, ConfigureStateBackend, HasChanges). Uses _override.tf for HTTP state backend, which may not work for remote-source Terragrunt setups.
go/deployment-operator/pkg/harness/tool/terragrunt/modifier.go	Adds PlanArgsModifier (injects -parallelism, -refresh, -out) and ApplyArgsModifier (appends plan file if not already present). Mirrors Terraform modifier exactly.
go/deployment-operator/pkg/harness/tool/terragrunt/terragrunt_templates.go	Embeds and renders _override.tf.gotmpl to configure HTTP remote state backend. Output file is _override.tf, which only takes effect when Terraform .tf files reside alongside terragrunt.hcl.
go/deployment-operator/dockerfiles/harness/terragrunt.Dockerfile	New multi-stage Dockerfile pulling Terraform, OpenTofu, and Terragrunt binaries. Downloads SHA256SUMS alongside the binary and verifies before installing.
lib/console/deployments/stacks/commands.ex	Adds terragrunt_commands/2 (plan, destroy, apply variants). Missing init step is intentional — Terragrunt auto-runs init.
lib/console/schema/stack.ex	Adds terragrunt to the Type enum (value 3) and embeds a Terragrunt configuration block. Changeset plumbing is correct.
assets/src/components/stacks/overview/StackConfiguration.tsx	Reads toolConfig from the appropriate configuration block (terraform vs terragrunt) and sends the matching mutation key. Mutation dispatch logic is correct.
go/controller/api/v1alpha1/infrastructurestack_types.go	Adds TERRAGRUNT to the StackType kubebuilder enum and TerragruntConfiguration type. Clean addition.
go/deployment-operator/pkg/harness/security/trivy/trivy.go	Adds StackTypeTerragrunt to the Terraform scan case — correct since Terragrunt wraps Terraform HCL.
test/console/deployments/stacks/commands_test.exs	Tests normal apply and destroy flows for Terragrunt. Missing coverage for the dry-run branch.

_{Reviews (2): Last reviewed commit: "add approvals, refresh and parallelism f..." | Re-trigger Greptile}

[maciaszczykm]

@greptileai