infra: enforce Terraform root vs child module layout

[ORESoftware]

Standardizes the existing .ores-infra.toml convention into an explicit Terraform root/child-module contract.

• modules/* is reusable, environment-agnostic child-module code with no backend/state ownership.
• environments/<env>/* is the root-module/state boundary and may mix module calls with true environment-only resources.
• adds a CI structural check for backend/state leakage into child modules and validates the configured modules/environments directory names.
• documents provider-native repo integration behavior separately from Terraform root-module selection.

This PR does not move existing Terraform resource addresses or state.