Adds github provider + ci.tf which provisions:
- KUBECONFIG GitHub Actions secret (from local kubeconfig)
- ghcr-credentials k8s pull secret in finance and auth namespaces
Run `terraform apply -var github_token=<PAT>` once after cluster setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
e018e627e3