test: run the tfstate tests on a building block of our own

[grubmeshi]

TestAccTfstate bootstrapped a block of meshstack-hub's noop e2e module, so a change in hub broke it (see 15fc759). The bootstrap now creates its own definition, which runs testdata/buildingblock, a single terraform_data, at the commit under test.

• feat: exec --override-backend writes the override into the directory of tofu -chdir=DIR (or terraform), parsed as OpenTofu's extractChdirOption does, and into the working directory otherwise.
• No dependency on meshstack-hub remains, and the runner needs neither nix nor awscli for this block.
• ref_name is the HEAD of the checkout. When the lane tests the PR's merge commit, which the runner cannot clone, it is the PR head. The test fails early with "push HEAD … first" when GitHub does not have the commit.
• A postcondition fails the bootstrap when the run does not succeed, since the provider only warns.
• The tofu execs run the runner's module with --override-backend; the concurrent execs each run their own copy. The override's unit test keeps only the refusal to replace an existing file.

🤖 Generated with Claude Code

[meshcloud-gh-actions]

Coverage of the acceptance run against the meshStack backend, on dd90a0df6b0b0187ee124f5bff3eb5719065ce20.

Scope	Coverage
Unit tests	78.6%
Acceptance tests	54.6%
Combined	80.5%

Uncovered functions

client/api_key.go:55: meshApiKeyClient.Create 0.0%
client/api_key.go:59: meshApiKeyClient.Read 0.0%
client/api_key.go:63: meshApiKeyClient.Update 0.0%
client/api_key.go:71: meshApiKeyClient.Delete 0.0%
client/api_key_permissions.go:20: ApiKeyPermissions.AllCodes 0.0%
client/api_key_permissions.go:33: ApiKeyPermissions.WorkspaceCodes 0.0%
client/api_key_permissions.go:295: AllApiKeyPermissions 0.0%
client/api_key_permissions.go:299: WorkspacePermissionCodes 0.0%
client/building_block_definition.go:71: MeshBuildingBlockDefinitionApprovalPolicies.NothingRequiresApproval 0.0%
client/building_block_definition.go:82: DisabledSchedule 0.0%
client/building_block_definition.go:89: MeshBuildingBlockDefinitionSchedule.IsDisabled 0.0%
client/building_block_definition.go:93: MeshBuildingBlockDefinitionSpec.HasNeutralPolicies 0.0%
client/building_block_definition.go:97: MeshBuildingBlockDefinitionSpec.WithNeutralPolicies 0.0%
client/building_block_definition.go:166: meshBuildingBlockDefinitionClient.List 0.0%
client/building_block_definition.go:173: meshBuildingBlockDefinitionClient.Read 0.0%
client/building_block_definition.go:177: meshBuildingBlockDefinitionClient.Create 0.0%
client/building_block_definition.go:181: meshBuildingBlockDefinitionClient.Update 0.0%
client/building_block_definition.go:185: meshBuildingBlockDefinitionClient.Delete 0.0%
client/building_block_definition_version.go:100: MeshBuildingBlockType.TagInputTargets 0.0%
client/building_block_definition_version.go:245: meshBuildingBlockDefinitionVersionClient.Create 0.0%
client/building_block_definition_version.go:254: meshBuildingBlockDefinitionVersionClient.Update 0.0%
client/building_block_definition_version_implementation.go:80: MeshBuildingBlockDefinitionImplementation.InferType 0.0%
client/building_block_definition_version_implementation.go:94: MeshBuildingBlockDefinitionImplementation.MarshalJSON 0.0%
client/building_block_definition_version_implementation.go:107: *MeshBuildingBlockDefinitionImplementation.UnmarshalJSON 0.0%
client/building_block_runner.go:82: meshBuildingBlockRunnerClient.Create 0.0%
... and 125 more

covdata func names a method without its receiver, so an entry can belong to an implementation nothing selects rather than to a function the tests never reached. Open the file and line before reading one as a coverage gap.