feat: add build job

- add build job that runs `make plan`
- enable provider caching
- enable creating client.crt/client.key
- trap EXIT to cleanup temp directory

Makefile

@@ -12,6 +12,7 @@ define vault_env
 	export PUPPET_CERT_PRIV=$$(vault kv get -field=private_key kv/service/puppet/certificates/terraform) && \
 	export TG_QUEUE_EXCLUDE_DIR="templates/base" && \
 	export TG_PROVIDER_CACHE=1 && \
+	export TG_TF_PATH=terraform && \
 	eval "$$(vault read -format=json kv/data/service/terraform/incus \
 	  | jq -r '.data.data | to_entries[] | "export \(.key)=\(.value|@sh)"')" && \
 	export INCUS_CONFIG_DIR=$$(mktemp -d) && \