feat: add repository-scoped GitHub roles

[glitchedmob]

Adds repository-scoped GitHub OIDC roles for all current shared-role consumers while leaving the legacy role intact for cutover.

• Add exact state-key access for infra-app-config, infra-dns, infra-gh, and infra-vm-workloads
• Limit trust to each repository's main branch and pull-request subjects
• Restrict state and resource mutations to main-branch sessions
• Grant infra-dns read-only SES identity access
• Grant infra-app-config scoped SES credential-user management
• Grant infra-vm-workloads scoped SSM access with main-only bootstrap credential reads
• Expose sensitive role ARN outputs for updating repository secrets
• Produce an additive plan of 12 additions, 0 changes, and 0 deletions