docs: document live apply workflow

[xnoto]

Summary

• document credentialed PR planning and fork behavior
• warn that every push to main performs a fresh live apply

Validation

• targeted pre-commit checks, terraform-docs, and secret scanning passed

Deployment impact

Merging invokes the standard live OpenTofu apply workflow; this is a documentation-only change and should produce no infrastructure changes.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# module.k3s.libvirt_cloudinit_disk.commoninit will be created
+ resource "libvirt_cloudinit_disk" "commoninit" {
+ id = (known after apply)
+ meta_data = <<-EOT
instance-id: k3s
local-hostname: k3s
EOT
+ name = "k3s_commoninit"
+ network_config = <<-EOT
version: 2
ethernets:
enp1s0:
dhcp4: true
enp2s0:
dhcp4: false
addresses:
- 192.168.102.2/24
EOT
+ path = (known after apply)
+ size = (known after apply)
+ user_data = (sensitive value)
}
# module.runner.libvirt_cloudinit_disk.commoninit will be created
+ resource "libvirt_cloudinit_disk" "commoninit" {
+ id = (known after apply)
+ meta_data = <<-EOT
instance-id: runner
local-hostname: runner
EOT
+ name = "runner_commoninit"
+ network_config = (sensitive value)
+ path = (known after apply)
+ size = (known after apply)
+ user_data = (sensitive value)
}
Plan: 2 to add, 0 to change, 0 to destroy.