refactor(iac): delete bespoke in-core infra-admin surface (infra-admin migration PR-3)

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build build-ui build-go test bench bench-baseline bench-compare lint fmt vet fix install-hooks clean ko-build build-wfctl vendor-infra-proto test-integration-admin
+.PHONY: build build-ui build-go test bench bench-baseline bench-compare lint fmt vet fix install-hooks clean ko-build build-wfctl
 
 # Common benchmark flags
 BENCH_FLAGS = -bench=. -benchmem -run=^$$ -timeout=30m
@@ -52,24 +52,6 @@ lint:
 		echo "workflow#699 guard: rpc Apply correctly absent"; \
 	fi
 
-# Run the T17 host-module integration test that exercises the live
-# workflow-plugin-admin gRPC plugin subprocess. The test itself
-# (module/infra_admin_integration_test.go) probes for the sibling
-# repo at ../workflow-plugin-admin and skips when absent — this
-# target makes the dependency explicit + lets CI pass an env var
-# to point at a pre-checked-out clone. Per
-# docs/plans/2026-05-27-infra-admin-dynamic.md Task 17.
-#
-# Usage:
-#   make test-integration-admin                    # uses ../workflow-plugin-admin
-#   WORKFLOW_PLUGIN_ADMIN_PATH=/path make ...      # explicit override
-test-integration-admin:
-	@if [ ! -f "$${WORKFLOW_PLUGIN_ADMIN_PATH:-../workflow-plugin-admin}/go.mod" ]; then \
-		echo "workflow-plugin-admin not found at $${WORKFLOW_PLUGIN_ADMIN_PATH:-../workflow-plugin-admin}; set WORKFLOW_PLUGIN_ADMIN_PATH or checkout the sibling repo"; \
-		exit 1; \
-	fi
-	GOWORK=off go test -run TestInfraAdmin_IntegrationWithLiveAdminPlugin -v ./module/
-
 # Format code
 fmt:
 	go fmt ./...
@@ -109,24 +91,6 @@ run-admin: build
 ko-build:
 	KO_DOCKER_REPO=ko.local ko build ./cmd/server --bare --platform=linux/$(shell go env GOARCH)
 
-# Refresh the vendored workflow-plugin-infra proto descriptor used by
-# the FieldSpec catalog parity test (iac/admin/catalog/
-# catalog_proto_parity_test.go). Run on every minor upstream
-# workflow-plugin-infra release; then update the `Source version:`
-# header inside iac/admin/testdata/infra.proto to match the new tag.
-#
-# Assumes workflow-plugin-infra is checked out as a workspace sibling
-# (../workflow-plugin-infra) per the workspace convention.
-vendor-infra-proto:
-	@if [ ! -f ../workflow-plugin-infra/internal/contracts/infra.proto ]; then \
-		echo "vendor-infra-proto: ../workflow-plugin-infra/internal/contracts/infra.proto not found"; \
-		exit 1; \
-	fi
-	@printf '// Vendored from GoCodeAlone/workflow-plugin-infra/internal/contracts/infra.proto\n// Source version: TODO-update-tag (sourced %s)\n// Refresh via: make vendor-infra-proto\n// Drift detection: catalog_proto_parity_test.go\n\n' "$$(date +%Y-%m-%d)" > iac/admin/testdata/infra.proto
-	@cat ../workflow-plugin-infra/internal/contracts/infra.proto >> iac/admin/testdata/infra.proto
-	@echo "Vendored infra.proto refreshed at iac/admin/testdata/infra.proto."
-	@echo "  -> update the 'Source version:' header to the upstream tag now."
-
 # Clean build artifacts
 clean:
 	rm -f server

cmd/wfctl/infra.go

@@ -113,8 +113,6 @@ func runInfra(args []string) error {
 			return fmt.Errorf("audit-state-secrets exited with code %d", rc)
 		}
 		return nil
-	case "admin":
-		return runInfraAdmin(args[1:])
 	default:
 		return infraUsage()
 	}
@@ -141,9 +139,6 @@ Actions:
   align          Validate IaC config + plan alignment (8 rule families)
   test           Hermetically validate expected infra config and plan outcomes
   security-check Scan plan.json for security policy violations
-  admin          Query the infra.admin host-side module surface
-                   (list-resources, get-resource, list-types,
-                    list-providers, generate-config, audit-tail)
   cleanup        Tag-based force-cleanup across providers (--tag NAME [--fix])
   owners         List cloud resources carrying a provider ownership marker
   audit-secrets  Report provider_credential anti-patterns in secrets.generate