build(terraform): take the AWS provider to 6.63.0 without losing the exact pin

Dependabot's #253 proposed the same 6.46.0 -> 6.63.0 bump and could not be
merged: its updater rewrote `version = "= 6.46.0"` to `version = "6.63.0"`,
dropping the operator that makes the pin exact, and
test_terraform_state_contract.py failed it (run 34213669766). It also locks
only linux_amd64, while the terraform-validate provider-lock step diffs all
three platforms. Done by hand instead, keeping both properties.

AWS_PROVIDER_VERSION in the contract test moves with main.tf, so the pin,
the lock and the assertion stay one fact in three places.

The lock was rebuilt one platform at a time. `terraform providers lock`
refuses to move a version the lock already records ("must use terraform init
-upgrade to allow selection of new versions"), so the sequence is
`init -backend=false -upgrade` first -- which records only the host platform
-- and then the lock command. Passing three platforms at once means three
~250 MB fetches in one process, which did not survive this link; the hashes
accumulate across invocations, so linux_amd64 and darwin_arm64 were added
separately and the file ends up byte-identical to what CI's single
three-platform command produces.

Verified: `terraform validate` Success against 6.63.0 (17 minors is enough
to remove an attribute; it does not), lock carries three h1: hashes plus the
registry zh: set, test_terraform_state_contract.py 14 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015HsJh4f7Lqv3XmkCPSA1uF

Author: JuliaEdom

infrastructure/terraform/.terraform.lock.hcl

@@ -17,7 +17,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "= 6.46.0"
+      version = "= 6.63.0"
     }
   }
 

infrastructure/terraform/main.tf

@@ -25,7 +25,7 @@
 WORKFLOW_FILES = sorted([*WORKFLOWS_DIR.glob("*.yml"), *WORKFLOWS_DIR.glob("*.yaml")])
 
 TERRAFORM_VERSION = "1.15.4"
-AWS_PROVIDER_VERSION = "6.46.0"
+AWS_PROVIDER_VERSION = "6.63.0"
 WORKFLOW_ENVIRONMENT_EXPRESSION = "${{ inputs.environment }}"
 STATE_KEY_INIT_LINE = re.compile(r'^terraform init -backend-config="key=(?P<key>[^"]+)"$')
 STATE_KEY_SHAPE = re.compile(r"^env/[^/]+/terraform\.tfstate$")