Applying a saved plan, so the review means something

Re-planning at apply time means the thing that runs is not the thing that was reviewed, which defeats the review entirely.

- run: terraform plan -out=tfplan -input=false
- run: terraform show -no-color tfplan > plan.txt
- uses: actions/upload-artifact@v3
  with: { name: tfplan, path: tfplan }

# and in the gated job
- uses: actions/download-artifact@v3
  with: { name: tfplan }
- run: terraform apply -input=false tfplan

A saved plan is tied to a specific state serial, so applying it after somebody else has applied theirs fails rather than doing something unexpected — which is the property that makes this safe rather than merely tidy. The plan file also contains the sensitive values, so the artifact needs the same treatment as the state.