fix(ci): remove hardcoded AWS profile from backend and provider

The S3 backend had profile=muon which doesn't exist in CI runners.
Removed profile from backend block (uses AWS_PROFILE env var locally,
OIDC env vars in CI). Made provider profile conditional — empty string
falls back to default credential chain. Added TF_VAR_aws_profile=""
to CI workflow env. Also removed OIDC debug step and fixed org name
casing in variables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Mohitsharma44

.github/workflows/terraform.yml

@@ -19,18 +19,16 @@ concurrency:
   group: terraform-${{ github.ref }}
   cancel-in-progress: false
 
+env:
+  TF_VAR_aws_profile: ""
+
 jobs:
   plan:
     name: Terraform Plan
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
 
     steps:
-      - name: Debug OIDC Token
-        run: |
-          IDTOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.amazonaws.com" | jq -r '.value')
-          echo "$IDTOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq '{sub, aud, iss, ref, repository}' || true
-
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 

infra/providers.tf

@@ -14,13 +14,13 @@ terraform {
     region         = "us-east-1"
     dynamodb_table = "cuspuo-terraform-lock"
     encrypt        = true
-    profile        = "muon"
+    # No profile here — uses AWS_PROFILE env var locally, OIDC env vars in CI
   }
 }
 
 provider "aws" {
   region  = "us-east-1"
-  profile = var.aws_profile
+  profile = var.aws_profile != "" ? var.aws_profile : null
 
   default_tags {
     tags = {

infra/variables.tf

@@ -23,9 +23,9 @@ variable "state_lock_table_name" {
 }
 
 variable "github_org" {
-  description = "GitHub organization name (lowercase, as used in OIDC sub claim)"
+  description = "GitHub organization name (case-sensitive, must match OIDC sub claim)"
   type        = string
-  default     = "cuspuo"
+  default     = "CUSPUO"
 }
 
 variable "github_repo" {