fix(ci): clear stale provider locks before init

The provider source moved from git.unkin.net/unkin/artifactapi to
artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi. .terraform.lock.hcl
is gitignored, so a CI runner reusing a workspace/cache keeps a lock pinning the
old source; some OpenTofu versions then try to re-resolve git.unkin.net (which
isn't a registry) instead of dropping it, failing init.

Delete any .terraform.lock.hcl before `terragrunt run --all init -- -upgrade` so
providers resolve purely from config.

Makefile

@@ -16,6 +16,11 @@ define vault_env
 endef
 
 init:
+	@# Drop any stale dependency locks so provider sources are re-resolved
+	@# purely from config. Locks are gitignored and CI can reuse a workspace
+	@# carrying a lock from an earlier (old provider source) run, which -upgrade
+	@# on some OpenTofu versions tries to re-resolve instead of dropping.
+	@find . -name '.terraform.lock.hcl' -not -path '*/.git/*' -delete
 	@$(call vault_env) && \
 	terragrunt run --all --non-interactive init -- -upgrade