Feature/fix tf runs with artifacts

[sttomm]

This PR contains a few fixes that were identified during e2e integration of preflight runs

[Copilot]

Pull request overview

This PR adjusts how Terraform/OpenTofu runs handle predecessor plan artifacts and ephemeral credentials, to better support preflight DETECT → APPLY workflows and avoid embedding revoked tokens into saved plans.

Changes:

• Switch meshStack HTTP backend authentication from backend-config headers (Bearer) to TF_HTTP_USERNAME/TF_HTTP_PASSWORD (Basic) so credentials are re-read fresh at plan/apply time.
• Make plan-artifact vs fresh-apply paths explicit in user-visible step logs, and adapt scenario tests accordingly.
• Deprecate run-scoped tfvars values for DETECT and saved-plan replays to avoid plan/input mismatches; add/adjust unit tests for these invariants.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tf-block-runner/tfrun/worker_scenario_test.go	Updates expected user-visible logs to include the new “fresh apply” notice.
tf-block-runner/tfrun/tfcmd.go	Moves backend auth to TF_HTTP_* env vars and changes meshStack variable emission/decls for saved-plan invariants.
tf-block-runner/tfrun/tfcmd_test.go	Adds/updates tests for tfvars emission behavior and TF_HTTP_* env setup; updates backend golden expectations.
tf-block-runner/tfrun/tfapply.go	Makes “apply predecessor plan” vs “fresh apply” user-visible via SystemMessage logs.
tf-block-runner/tfrun/testdata/backend.golden.tf	Updates golden backend config to no longer contain auth headers.
go-meshapi-client/meshapi/client.go	Removes same-origin enforcement for authenticated artifact downloads (security-sensitive).
go-meshapi-client/meshapi/client_test.go	Removes the regression test that ensured cross-origin artifact URLs are rejected.

Comments suppressed due to low confidence (1)

go-meshapi-client/meshapi/client.go:131

• DownloadArtifact now sends the client's Authorization header to whatever absolute URL is provided. Since artifactURL comes from an API response, this enables bearer-token leakage and runner-mediated SSRF if a malicious/buggy server ever returns a cross-origin href. Please restore a same-origin check (scheme + host match with c.baseURL) before calling setHeaders / issuing the request.

func (c *Client) DownloadArtifact(artifactURL string, w io.Writer) error {
	req, err := http.NewRequest(http.MethodGet, artifactURL, nil)
	if err != nil {
		return fmt.Errorf("download artifact %s: failed to create request: %w", artifactURL, err)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[grubmeshi]

LGTM, see some stylistic improvements.