[superseded by #2640] feat: infer dependency graph triggers from imports

[vedant-rox]

Superseded as the first reviewable slice by #2640.

Keeping this PR open only as historical/staging context for the earlier broader approach. If you are reviewing #791, please use #2640 for the current smaller matching-focused slice.

Summary

• add opt-in dependency_file_triggers support for Terraform and OpenTofu projects so Digger derives trigger paths from real local module imports
• derive trigger patterns for manual and generated Terragrunt projects from the parsed Terragrunt dependency graph, infer matching project dependency edges, and rebuild the project dependency graph after enrichment
• harden manual Terragrunt trigger discovery so dependency_file_triggers does not execute run_cmd, get_env, sops_decrypt_file, or AWS identity helper functions through nested read_terragrunt_config, while preserving supported read_terragrunt_config(...).locals and read_terragrunt_config(...).inputs access
• keep behavior default-off, document the new setting, and cover the flow with regression tests

Notes

• not the primary review target
• feat: add dependency file triggers for terraform matching #2640 is the current first reviewable slice for Terraform/OpenTofu matching
• this branch does not yet implement output-aware downstream triggering or apply-before-plan sequencing
• I have not yet validated this in the demo GitHub Actions repo from CONTRIBUTING.md

AI Disclosure

• This PR was developed with substantial AI assistance via OpenAI Codex/ChatGPT, with human review and iterative fixes for the code, tests, and PR responses.

[s1ntaxe770r]

Hey @vedant-rox ,

This pr seems to be doing a lot, as such it is hard for me or anyone else to review at this time. Do you mind opening smaller pr's that have or can be verified in a github action ?

[vedant-rox]

Split out the first smaller slice here: #2639

That PR contains only the Terraform/OpenTofu dependency_file_triggers work plus docs/tests, and explicitly leaves Terragrunt support out so it is easier to review and validate independently in GitHub Actions.

I’ll keep the Terragrunt-specific trigger discovery and hardening as follow-up work rather than force it through this larger PR.

[vedant-rox]

Superseded by #2640 as the current first reviewable slice, with #2639 kept as the follow-up branch for the remaining behavior changes.