ci: conditional plan + artifact upload

[awsvkvims]

What

Enhance Terraform CI workflow to:

• Run terraform plan only when AWS credentials are configured
• Skip plan safely when credentials are not present
• Upload plan artifact only when plan runs successfully

Why

Prevents CI failures when AWS credentials are not configured,
while still allowing full plan + artifact generation when secrets are available.

This keeps PR validation stable (fmt + validate always run)
and prepares the workflow for future credential-based plan enforcement.

Note:

secrets context is not available in an if: conditional at the step level. GitHub blocks this for security reasons to prevent leaking secrets through logic flow.

To check if a secret exists in a conditional, it must first be mapped to an environment variable , then that environment variable can be checked.