Design wfctl infra config/plan tests

[intel352]

Problem

Terraform has first-class tests for Terraform files because HCL can include dynamic evaluation, loops, and transformations. wfctl is not yet targeting highly complex infra, but Workflow config is moving toward richer provider-driven IaC behavior, and we need a test story before complex config semantics create Terraform-like pitfalls.

Goal

Design and implement a way to validate expected outcomes of wfctl/Workflow infrastructure configuration without contacting live providers by default.

Questions to answer

• Should tests assert rendered config, resolved provider inputs, computed plan shape, or all of these?
• How do strict contracts/proto validation participate in the test boundary?
• How do provider plugins expose deterministic plan fixtures or fake providers?
• How do we avoid duplicating Terraform pain points: hidden dynamic behavior, hard-to-debug eval order, and provider-specific drift from expected output?
• What is the smallest useful wfctl infra test or wfctl test syntax for app repos?

Acceptance sketch

• A config author can write a test that validates an infra config produces expected resources/inputs/plan actions.
• Tests are hermetic by default and do not require cloud credentials.
• Provider/plugin contracts remain strict by default.
• Destructive operations are impossible in test mode.
• Fixtures can cover generated or dynamic resource collections, such as N subnets or multiple app components.