[WM-IMP-12] Terraform provider versions not pinned — infrastructure drift risk

## WM-IMP-12 — Terraform Version Pinning Missing

**Category:** Improvement | **Priority:** Low

### Observation
Terraform provider versions are not pinned, creating infrastructure drift risk where different runs may use different provider versions.

### Recommendation
Pin all Terraform provider versions in `required_providers` blocks and commit `.terraform.lock.hcl`.

### Acceptance Criteria
- [ ] All Terraform providers have explicit version constraints in `required_providers`
- [ ] `.terraform.lock.hcl` committed to source control
- [ ] Terraform version itself pinned in CI (e.g., via `tfenv` or explicit version in pipeline)
- [ ] Dependabot or Renovate configured to propose provider version updates