lablink-allocator-service v0.2.0

Switches the AWS provisioning path from Terraform to OpenTofu 1.12.5.

Breaking

• The image now ships tofu, not terraform. Every subprocess call site invokes tofu. A prod image must be built from this version — an image built from an older package alongside the new Dockerfile gets the tofu binary with Python that still calls terraform, and fails at container boot.
• VM-table columns renamed TerraformApply{StartTime,EndTime,DurationSeconds} → TofuApply*. Safe in place because the schema is generated fresh per deployment; there is no migration machinery.
• Client-VM floor raised to OpenTofu >= 1.10.0 in terraform/versions.tf.

Why 1.10.0 and not 1.9.0

The floor guards an S3 state-corruption bug (aws/aws-sdk-go-v2#2485, surfaced as hashicorp/terraform#34528) where a retried state upload fails after the apply has run. The Terraform fix was a pure SDK bump, so exposure follows the vendored SDK rather than the release number:

	aws-sdk-go-v2
Terraform 1.7.4	v1.24.0	known buggy
Terraform 1.7.5	v1.25.3	known fixed
OpenTofu 1.6.0 → 1.9.x	v1.23.2	never took the fix
OpenTofu 1.10.0	v1.36.0	first release past it

Translating Terraform's old 1.9.0 floor across by number would have admitted exactly the versions the check exists to reject.

Not breaking

State is compatible both ways — both tools write format version: 4, and Terraform 1.9.6 was verified to read and rewrite state written by OpenTofu 1.12.5. No .tf resource definitions changed.

Also

• tofu read failures are no longer reported as "no state found". get_tofu_outputs raises TofuError carrying tofu's own message, so an expired credential says so instead of implying the deployment is missing.
• Raw tofu output is no longer parsed as Rich markup — a bracketed path such as [/var/lib/state] used to abort the command that was reporting the error.
• Operator-facing logs, the admin UI, and CLI output now say OpenTofu.

Names kept deliberately: terraform.tfstate, .terraform.lock.hcl, terraform.runtime.tfvars (OpenTofu writes those filenames), the instance_terraform_apply_times output, and dns.terraform_managed.

See #446.