terminal: term.<domain>, the browser terminal, from the release's signed copy

[aledbf]

Security zone: for you to merge. The AWS half of F8's browser terminal (spin#274, merged): modules/terminal serves https://term.<domain> from a spin release's signed spin-term.tar.gz.

What it makes

• A bucket and a CloudFront distribution on an origin of its own.
  • Nothing of the installation serves the code that asks a person's passkey.
  • The bucket is private, read only through the distribution (OAC).
  • Its policy denies every write by a role of the installation (role/${iam_name}-*): a taken control plane cannot replace the page.
• A strict Content Security Policy:
  • the page may reach app.<domain> (the dashboard's API, with the person's session, for the six calls the control plane allows from this origin) and the relay's WebSocket, and nothing else;
  • wasm-unsafe-eval for the terminal's Go.
• The certificate comes from us-east-1, as CloudFront takes it, via an aws.us_east_1 provider, and is validated in the installation's public zone.

Pinned to the release

• files is a directory task term:fetch RELEASE=<tag> OUT=term made. It verifies the tarball with cosign against the signature spin's release workflow made at that tag before it unpacks it.
• A plan whose files are another release's than release is refused by a precondition on RELEASE.

Not yet deployable

No spin release ships spin-term.tar.gz yet. The first release cut after spin#274 does, and the module can be wired into an installation from then. The module's tests (modules/terminal/tests) run against fixtures and do not need it.

Gates

task lint passes: fmt, validate, tflint, docs, and the module's terraform test (2 runs: the page published as the release's, and files of another release refused).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}