M4: the water park entry over #384's bare Terraform directory (#386)

[lex00]

Child of #386, M4. The Terraform leg. The serve path itself is #384 (child of #378), specified there in full — the lexicon-resolution decision, root discovery, the member-kind-or-not question, definition of done and acceptance. Build #384 as written; this issue is only the catalog entry on top of it.

The entry

waterpark in workbench.json: local, inPlace, path: ../waterpark/access, no setup, no env. Served through #384's bare-directory path. Expected roots on that estate (measured for #384): envs/prod, identity, github, baseline, satellites/waterpark-runner; modules/persona is a called module and must NOT be a root of its own. envs/dev holds only a README.

Definition of done

• serve a bare Terraform directory: generate the reader config in a scratch dir, so an estate needs no file of its own (#378) #384's own definition of done and acceptance.
• behold demo waterpark renders the roots as boxes with no file written under ../waterpark (assert with git -C ../waterpark status --porcelain empty before and after, in the e2e).
• serve a bare Terraform directory: generate the reader config in a scratch dir, so an estate needs no file of its own (#378) #384's optional-dependency decision, whichever way it goes, is recorded in serve a bare Terraform directory: generate the reader config in a scratch dir, so an estate needs no file of its own (#378) #384 and in AGENTS.md's "Rendering a Terraform estate".

[lex00]

Merged in #392 (072480e), released in @intentius/behold@0.18.0.