Investigate selective YAML-function evaluation in the output executor (follow-up to #2356)

## Background

#2356 patched a regression where the `after-*` store hook path
(`GetOutputSkipInit` → `fetchAndCacheOutputs` → `execute()`) was
regenerating `backend.tf.json` / `providers_override.tf.json` from
un-rendered component sections, corrupting the files.

The fix in #2356 adds a guard that skips artifact regeneration when
`ProcessYamlFunctions == false`. That avoids the corruption but also
avoids legitimate re-rendering when the hook happens to have some of
the information it needs.

## What this issue tracks

Revisit the assumption in `pkg/terraform/output/executor.go` that auth
availability gates **all** YAML-function evaluation:

```go
processYamlFunctions := true
if opts != nil && opts.SkipInit && authManager == nil {
processYamlFunctions = false
}
```

Most YAML functions — `!terraform.state`, `!terraform.output`, `!env`,
`!exec`, `!include`, `!template`, `!literal`, `!random`, `!repo-root`,
`!cwd` — don't require an atmos auth manager. Only a subset (`!aws.*`,
some `!store` backends) genuinely does.

Proposed direction: classify YAML functions by auth requirement and
evaluate the auth-free subset even when `authManager == nil`. This
removes the all-or-nothing toggle and lets more scenarios (e.g. an
`after-apply` hook whose backend uses `!terraform.state` against a
local state file, without any AWS creds) work correctly without
needing the blanket artifact-regen skip.

## Acceptance

- [ ] Design doc classifying each YAML function by auth requirement.
- [ ] Refactor of the `ProcessYamlFunctions` guard in
`pkg/terraform/output/executor.go` to evaluate the auth-free subset
even without an auth manager.
- [ ] Once the guard is fixed, revisit whether the
`if processYamlFunctions { ... }` wrap on Steps 4/5 of `execute()`
(added by #2356) is still needed. If the auth-free subset always
resolves, the guard can likely be removed or narrowed further.

## Non-goals

- Changing YAML function syntax or adding new functions.
- Making the `!aws.*` family work without credentials.

Start in pkg/terraform/output/executor.go, especially the ProcessYamlFunctions guard and the Steps 4/5 wrapping in execute(); review the YAML functions listed in the issue and the follow-up context from #2356. Done means documenting which functions require auth, evaluating the auth-free subset without an auth manager, and revisiting the artifact-regeneration guard without changing function syntax or AWS behavior.

Written by the indexing model from the issue text.