Census approval: sec-host-imdsv2-module

Ruling census-ruling-sec-host-imdsv2-module. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

| unit | change | read sites | what changed | |---|---|---|---| | infra/modules/region-host/main.tf external | body | unchanged (1) | awsinstance.host gains metadataoptions (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host; tofu configuration only, run on an operator's machine; no read, file or record write is added; applies in place on a running instance with no restart |

Envelopes re-pinned: infra/modules/region-host.

Seal: 09e20ea4bbc534710334e632e903878656dabfb5817d4d96c6e7c56508172148 → 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a.

Overlay: internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv, appended to internal/provision/testdata/plan14-root-reads-chain.tsv.

Branch context

The branch sec-host-imdsv2-module adds a metadata_options block to aws_instance.host in infra/modules/region-host/main.tf (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host, and a plan-time tofu test under infra/modules/region-host/tests/. The record-write census does not change: no record write is added or moved.

The new tests/instance_metadata.tftest.hcl is outside the census: the scan's extension list excludes .tftest.hcl, and envelopes group by immediate directory, so the module hash covers only the .tf files.

Executing identity: tofu on an operator's machine with the operator's AWS credentials; no box unit runs the file and no binary embeds it.