feat(action): configurable Terraform version and an OpenTofu switch

The GitHub Action takes a pre-made plan document (input-path) and exposes no terraform-version
input and no way to declare the plan came from OpenTofu. The Terraform version is only stamped on
the platform workflow at creation, so users on a pinned version — or on tofu — cannot express that
from the Action, and the platform runner may evaluate with a mismatched toolchain. The version
shown on the platform should match the version the git code declares.

Proposal. Two new Action inputs, threaded through to the platform payload:

• terraform-version — recorded on the created workflow and the run.
• iac-tool: terraform | opentofu (default terraform) — declares the producing tool, selects the
  tofu binary where one is run, recorded on the run for provenance.

Mirror the same inputs in the GitLab component and the Bitbucket Pipe so the three CI surfaces stay
flag-compatible. Document alongside: running the workflow on a private runner + private bucket so
the sensitive plan/state never leaves the user's infrastructure.

Acceptance. A workflow created through the Action carries the requested Terraform version; a
tofu-produced plan evaluated with iac-tool: opentofu runs end to end and the run records the
tool; README documents both inputs with a tofu example.

Start by tracing the existing GitHub Action input handling into the platform payload, then inspect the GitLab component and Bitbucket Pipe for their corresponding inputs. Verify the version and iac-tool values reach created workflows and runs, including the OpenTofu path. Done means all three CI surfaces expose matching inputs and the README includes both inputs, a tofu example, and the private-runner/private-bucket guidance.