Set TFLint `soft-fail: false` in PR validation and main workflows

[WilliamBerryiii]

Summary

The TFLint CI workflow was introduced in PR #229 with soft-fail: true in both pr-validation.yml and main.yml to allow initial rollout without blocking PRs. This issue tracks flipping to soft-fail: false so TFLint violations become enforced.

Current State

Workflow	File	soft-fail
PR Validation	.github/workflows/pr-validation.yml (L146)	true
Main	.github/workflows/main.yml (L121)	true
Reusable workflow default	.github/workflows/terraform-lint.yml	false

The reusable workflow already defaults to false — the callers explicitly override it to true.

Tasks

• Fix all existing TFLint violations across infrastructure/terraform/
• Set soft-fail: false in .github/workflows/pr-validation.yml
• Set soft-fail: false in .github/workflows/main.yml
• Verify CI passes on a test PR with hard-fail enabled

Context

• PR feat(build): add TFLint reusable GitHub Actions workflow #229: feat(build): add TFLint reusable GitHub Actions workflow #229
• Review discussion: feat(build): add TFLint reusable GitHub Actions workflow #229 (comment)
• TFLint version: v0.61.0