docs: rebuild KB in OKF v0.1 with live-verified facts

Copy of the legacy ~/.pi/agent/docs tree rebuilt as the command-center
knowledge base: concept files promoted to path identity, index listings
stripped of frontmatter, all wikilinks/relative links resolved, every
checkable claim verified against the live fleet (Dankserver = Ryzen 7
7700X + RTX 3090; Strix Halo is Dankclaw), unverifiable claims tagged.
kb-lint exits 0.

omp-docs/engineering/infra/terraform.md

@@ -0,0 +1,79 @@
+---
+type: reference
+title: Terraform and OpenTofu
+description: Current best practices for Terraform and OpenTofu - module structure, state management, backends, and orchestration.
+tags:
+  - terraform
+  - opentofu
+  - iac
+  - infrastructure
+  - engineering
+timestamp: 2026-08-11
+verified: 2026-08-28
+---
+# Terraform and OpenTofu
+
+This page covers current (2025/2026) best practices for Terraform and OpenTofu.
+
+## OpenTofu vs Terraform
+
+OpenTofu is the open-source fork of Terraform. It uses the MPL 2.0 license. Terraform moved to the Business Source License. Both remain compatible with the same configurations and most providers.
+
+Use OpenTofu when license portability matters. Use Terraform when you need HashiCorp's commercial extensions.
+
+## Module Structure
+
+Separate infrastructure into layers:
+
+```
+infrastructure/
+├── modules/           # Reusable building blocks
+└── environments/
+    ├── dev/
+    ├── stage/
+    └── prod/
+```
+
+Environment modules call the reusable modules. Root modules declare providers and the backend.
+
+## State Management
+
+Never commit `.tfstate` to version control. Use a remote backend only.
+
+The AWS remote backend uses S3 and DynamoDB:
+
+* `bucket` for the state bucket.
+* `key` for the state file path.
+* `dynamodb_table` for state locking.
+* `encrypt` for encryption at rest.
+
+Enable versioning and server-side encryption on the state bucket.
+
+Use separate state files per environment. Do not use workspaces for separate environments.
+
+## Security and Lifecycle
+
+* Mark sensitive values with `sensitive = true`.
+* Pin provider versions with `required_providers`.
+* Run `terraform import` to adopt existing infrastructure.
+* Run `terraform plan` periodically to detect drift.
+* Use lifecycle blocks for resource replacement policies.
+
+## Related Tools
+
+* Terragrunt for orchestration: DRY config, hooks, and run queues.
+* Pulumi for infrastructure as code in real programming languages.
+* Packer for building machine images.
+* Atlantis for pull request based Terraform CI/CD.
+
+## Citations
+
+* [Terraform documentation](https://developer.hashicorp.com/terraform)
+* [OpenTofu](https://opentofu.org/)
+* [Terragrunt](https://terragrunt.com/)
+* [AWS backend](https://developer.hashicorp.com/terraform/language/settings/backends/s3)
+
+## See Also
+
+* [Cloud Providers](cloud.md)
+* [Kubernetes](kubernetes.md)