ci: add CI workflow with fmt, validate, docs, lint, and release-please jobs

Replace the standalone release-please workflow with a unified CI
workflow that runs formatting checks, terraform validate, docs
freshness, and tflint on every push. Release-please is now handled
by jimeh/release-please-manifest-action with GitHub App auth.

Also:
- Move release-please config files under .github/
- Add changelog-sections and always-update to release-please config
- Add tflint with recommended terraform plugin preset
- Add .gitignore for .terraform/ and .terraform.lock.hcl
- Add lint and lint-fix Make targets
- Clean .terraform.lock.hcl before terraform-docs runs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/release-please-config.json

@@ -0,0 +1,31 @@
+{
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "changelog-path": "CHANGELOG.md",
+      "bump-minor-pre-major": true,
+      "bump-patch-for-minor-pre-major": true,
+      "draft": false,
+      "prerelease": false,
+      "always-update": true,
+      "include-component-in-tag": false,
+      "extra-files": [
+        "README.md"
+      ],
+      "changelog-sections": [
+        { "type": "feat", "section": "Features" },
+        { "type": "fix", "section": "Bug Fixes" },
+        { "type": "perf", "section": "Performance Improvements" },
+        { "type": "revert", "section": "Reverts" },
+        { "type": "docs", "section": "Documentation" },
+        { "type": "style", "section": "Styles", "hidden": true },
+        { "type": "chore", "section": "Miscellaneous", "hidden": true },
+        { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+        { "type": "test", "section": "Tests", "hidden": true },
+        { "type": "build", "section": "Build System", "hidden": true },
+        { "type": "ci", "section": "CI", "hidden": true }
+      ]
+    }
+  },
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}