Add cnames to the smoke wrapper as a cross-module provider guard

The quilt/cnames provider conflict went unnoticed because CI only ever
validates each module standalone — no job composed two modules in one
root, so their combined AWS provider constraints were never resolved.

Compose `cnames` alongside `quilt` in the smoke wrapper so the test
job's `terraform init` resolves both modules' constraints together. A
future incompatible pin on either module now fails init in CI (verified:
reverting cnames to `~> 5.0` makes this wrapper's init fail). Also drops
the now-stale cnames note from the root provider-pin comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sir-sigurd

modules/quilt/tests/smoke/main.tf

@@ -16,8 +16,7 @@ terraform {
       source = "hashicorp/aws"
       # Match what the modules under test transitively require: the
       # terraform-aws-modules/vpc ~> 6.0 module needs aws >= 6.28. Pinning keeps
-      # CI deterministic and off a future major. (Note: examples/main.tf and
-      # modules/cnames still pin ~> 5.0, which is incompatible with that floor.)
+      # CI deterministic and off a future major.
       version = "~> 6.0"
     }
   }
@@ -87,6 +86,20 @@ module "quilt" {
   user_subnets        = var.user_subnets
 }
 
+# Compose `cnames` in the same root as `quilt` so CI resolves their combined
+# AWS provider constraints at init. This is the regression guard for the
+# quilt (vpc → aws >= 6.28) vs cnames conflict: a future incompatible pin on
+# either module fails `terraform init` here. Inputs are literal dummies — the
+# guard is provider resolution + plan wiring, not value flow from the (mocked)
+# quilt outputs.
+module "cnames" {
+  source = "../../../cnames"
+
+  zone_id        = "Z00000000000000000000"
+  quilt_web_host = "quilt-test.example.com"
+  lb_dns_name    = "test-lb.example.com"
+}
+
 # Re-expose ONLY the non-sensitive stack name. Do not output module.quilt.stack
 # (it embeds the DB URL + admin password) or any *_password value — a sensitive
 # root output makes `terraform test` fail, which is the whole reason this

modules/quilt/tests/smoke/smoke.tftest.hcl

@@ -4,6 +4,8 @@
 # Plan-only with the AWS provider mocked: no credentials, no infrastructure.
 # Exercises the full wiring (vpc + db + search + the CloudFormation stack), so
 # a change that breaks the public boundary or the vpc pass-through fails in CI.
+# The wrapper also composes the `cnames` module (see main.tf), so an AWS
+# provider constraint that can't resolve across quilt + cnames fails at init.
 #
 # Assertions reference known inputs (the stack name), not mocked computed
 # attributes, whose generated values are intentionally arbitrary.