Validate Terraform import resource names

[9904099]

Summary

Fixes #1 by validating Terraform import resource names before the tool constructs import addresses, runs terraform import, or writes generated import commands.

The legacy importer previously accepted names like web-server and built addresses such as aws_instance.web-server. That is not a valid Terraform resource local name and can send the legacy import flow down an unsafe path. This change centralizes address construction through a validator so invalid local names are rejected consistently with a clear error that includes the resource type and name.

Changes

• Added Terraform local-name validation using [A-Za-z_][A-Za-z0-9_]*.
• Reused the same validated address helper for real imports, dry-run output, and generated import scripts.
• Made invalid dry-run rows report as failures instead of silently printing unsafe commands.
• Prevented generated shell scripts from being written when any resource name is invalid.
• Extracted CSV loading into load_resources_from_csv() so CSV-driven import input is covered by focused tests.
• Added deterministic unittest coverage for valid names, hyphenated invalid names, generated-script rejection, dry-run failure reporting, and CSV-driven resource loading.

Testing

Ran locally:

python3 -m py_compile tools/terraform_import.py tools/test_terraform_import_validation.py
python3 tools/test_terraform_import_validation.py -v
git diff --check HEAD~2..HEAD
python3 build.py

Results:

• py_compile: passed
• unittest: 5 tests passed
• git diff --check: passed
• python3 build.py: 10/10 modules passed

Diagnostic artifacts committed in this PR:

• diagnostic/build-b5a1edca.json
• diagnostic/build-b5a1edca-part001.logd
• diagnostic/build-b5a1edca-part002.logd
• diagnostic/build-b5a1edca-part003.logd
• diagnostic/build-b5a1edca-part004.logd

Diagnostic password:

3f63786617bfbb3367d0

Reassemble command from the build output:

cat diagnostic/build-b5a1edca-part001.logd diagnostic/build-b5a1edca-part002.logd diagnostic/build-b5a1edca-part003.logd diagnostic/build-b5a1edca-part004.logd > diagnostic/build-b5a1edca.logd
encryptly unpack diagnostic/build-b5a1edca.logd <outdir> --password 3f63786617bfbb3367d0

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging