chore(gha): adopt the new jsii-terraform image and test Terraform 1.5.7 + 1.16.1

[jsteinich]

Related issue

Follow-up to #394. Step 2 of the sequencing agreed in #337. Rebased on #383, which unblocks the ceiling half.

Description

Three commits, all consequences of #394 having published a new image and #383 having fixed cdktn get on modern Terraform.

1. Bump the pinned image digest — all 27 references across 11 workflow files move to sha256:62c00a31..., the image built from 2f29d5a. Confirmed to be that build: :latest and the immutable 0.24.0-2f29d5a8d45b047c5450eee9640e1cbaaee98c8d tag resolve to the same digest. First image carrying OpenTofu 1.12.6, Terraform 1.5.7 and 1.16.1, the fail-fast install layers and the post-install binary verification.

2. Move the floor leg from Terraform 1.5.5 to 1.5.7 — 1.5.7 is the newest pre-fork release and the exact floor cdktn already declares. DEFAULT_TARGET_VERSIONS in packages/cdktn/src/validations/target-versions.ts is { terraform: ">=1.5.7", opentofu: ">=1.6.0" }, so every project that declares no targetVersions is told 1.5.7 is supported, while CI was testing 1.5.5 — a version nothing declares.

3. Raise the ceiling from 1.6.5 to 1.16.1 — unblocked by #383 (54a8217). cdktn get was broken from Terraform 1.15.7 onward for any module declaring configuration_aliases (#379); until that fix was in main this would have landed red.

Both version changes are renames of existing legs, not additions — tested goes from ["1.5.5", "1.6.5"] to ["1.5.7", "1.16.1"], so the integration cross-product keeps the same job count and the CI bill is unchanged. The two legs now span the declared floor and current stable instead of two adjacent 2023 releases, which is what #337 needed in order to exercise the newer-protocol schema sections (functions, ephemeral_resource_schemas, write_only) at all — the previous 1.6.5 ceiling structurally could not emit them.

default moves to 1.16.1 with it. That drives the examples matrix (tools/build-example-matrix.mjs reads .default) and — less obviously — every provider-integration run: provider-integration.yml's terraform_version input is defaulted rather than passed, and none of its three callers override it. The duplicated unit-test matrices in pr-unit.yml and release.yml move with it too.

Deliberately not included

• Pruning 1.5.5 and 1.6.5 from available. They are unreferenced now, but editing .terraform.versions.json only rebuilds the image on merge — the workflows stay pinned to the current digest, so the prune would not take effect until a later bump. It belongs with the next digest bump.
• tools/generate-function-bindings/function-availability/functions-matrix.json still lists 1.6.5. That is generated function-availability data covering every release, not a CI version.

Follow-ups

• Derive the terraform_version matrices in pr-unit.yml and release.yml from .terraform.versions.json instead of duplicating tested in three places, so a version change is a one-file edit.
• OpenTofu coverage (CI: thin-slice runtime coverage for newer-protocol features on current stable Terraform AND OpenTofu #337 step 3) still needs the pin mechanism plus dependency-manager: migrate to opentofu registry #208, test(tofu): Track OpenTofu provider signing support in matcher tests #301, test(tofu): terraform-cloud test feeds the matrix version into an HCP Terraform workspace, blocking an OpenTofu matrix leg #392, provider-generator: generated docs links use the fetching CLI's registry hostname, producing 404s under OpenTofu #393.

Checklist

• I have updated the PR title to match CDKTN's style guide
• I have run the linter on my code locally
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation if applicable — n/a
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works if applicable — n/a; this PR's own CI run is the verification, since it exercises the new image on both new version legs
• New and existing unit tests pass locally with my changes — n/a, no source changes

🤖 Generated with Claude Code