Migrate homelab-workspace template toolchain from Terraform to OpenTofu

[ppat]

What

Migrate this repo's authoring/linting/CI toolchain for templates/kubernetes/homelab-workspace/ from HashiCorp Terraform to OpenTofu (the Linux Foundation–hosted fork), and make the live Coder deployment's provisioner actually apply templates with OpenTofu too. Deliberate breaking change, not a compatibility shim.

Other Terraform-authored repos (e.g. homelab-ops-terraform) are explicitly staying on Terraform and are out of scope here.

Why

HashiCorp's 2023 BSL relicensing of Terraform core prompted the OpenTofu fork; providers themselves stayed MPL-2.0 and both registries speak the same protocol, so there's no technical reason this template can't move.

Research (private gists, linked here so anyone following this public issue can read them)

• Coder platform ↔ OpenTofu compatibility
• OpenTofu provider registry & licensing compatibility
• Terraform vs OpenTofu language/state deltas

Key findings

• Every HCL construct this template actually uses is fully backward-compatible.
• Coder's provisioner has no dedicated OpenTofu support: plain LookPath("terraform") + numeric version-range check, no vendor check. coder template push never execs terraform/tofu at all — it's a local HCL parse.
• This template is genuinely coupled to OpenTofu's own registry, not just backward-compatible with either tool in the abstract. required_providers pins explicit registry.opentofu.org hosts; .terraform.lock.hcl was regenerated via tofu init — for hashicorp/kubernetes, that lock file records hashes for a binary OpenTofu rebuilt from source, not the original HashiCorp artifact. This is why the live provisioner needed to move too.
• CI tooling ecosystem is a clean go: mise has a native opentofu tool, tflint parses HCL directly, gruntwork-io/pre-commit ships tofu-fmt/tofu-validate hooks, Renovate's terraform-provider datasource is tool-agnostic.
• Real-CI-only failure modes, invisible to local checks, caught only by watching each PR's own CI through to completion (full detail in commit history of each PR): this repo's Actions allowlist rejecting opentofu/setup-opentofu; a $GITHUB_ENV same-step scoping mistake; a Kubernetes image-volume subPath limitation on this cluster's containerd version.

Status

• Research complete, decision made: go.
• ppat/github-workflows#631 — new lint-opentofu.yaml reusable workflow. Merged, released as v6.1.0.
• ppat/coder#898 — toolchain swap + CI wiring. Merged.
• ppat/homelab-ops-kubernetes-apps#3900 — live coderd deployment's provisioner applies templates with OpenTofu too, via an init container copying the tofu binary into an emptyDir and subPath-mounting it over /usr/local/bin/terraform. Marked as a breaking change (feat(apps-coder)!), since it affects every workspace template in the deployment, not just homelab-workspace. All CI green including the real chainsaw deployment test. Open, ready for review.
• Docs (CLAUDE.md, TESTING.md, DESIGN.md, README.md) updated to describe the OpenTofu-based toolchain as the current state.
• Not Renovate-managed: ghcr.io/opentofu/opentofu's tag in #3900 — bump by hand alongside ppat/coder's mise.toml pin, or add a customManager regex in a follow-up if that friction turns out to matter.

Only #3900 remains open. This issue stays open until that lands too.