Simulate blast radius before terraform apply

TL;DR: Before applying, build a speculative post-apply database from the plan and report everything that would actually be affected — including hidden effects from authoritative rule-set resources — not just what the plan itself touches.

User story

As an infrastructure engineer, I want to see the full blast radius of a terraform apply before it runs, so I don't get surprised by an outage from a destroy/replace I didn't realize mattered.

Acceptance criteria

• apply builds a speculative post-apply Datomic db from the plan (same d/with pattern as Policy Check)
• Report includes structural dependents of destroyed/replaced resources
• Report includes reachability diffs (current vs. simulated) via the existing Reachability graph search
• Destroying/replacing an authoritative rule-set resource (e.g. aws_network_acl, authoritative aws_security_group_rule, aws_default_security_group) reports its full implicit effect on sibling/child state, not just its direct Terraform references
• A global flag, default off, turns the report into a blocking gate (apply refused if blast radius is non-empty)
• With the flag off, apply proceeds unchanged regardless of blast-radius findings

How to verify

Terraform-manage a security group with an authoritative rule-set resource plus an out-of-band ingress rule added directly via AWS API. Plan a destroy of the rule-set resource. Confirm the blast-radius report lists the out-of-band rule and any workload that loses reachability as a result — with the flag off, apply still proceeds; with it on, apply is blocked.

Out of scope

• Any UI beyond CLI output
• Changing Policy Check's own blocking behavior

Start with the apply flow and the existing Policy Check implementation, especially its speculative d/with pattern. Trace the Reachability graph search and how authoritative rule-set resources represent implicit effects. Done means reporting structural dependents and reachability changes, verifying the AWS security-group scenario, and honoring the default-off blocking flag.