Wire Forge-native release infrastructure

Scripts/openbao-tofu.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(
+  git rev-parse --show-toplevel 2>/dev/null || {
+    cd "$(dirname "${BASH_SOURCE[0]}")/.."
+    pwd
+  }
+)"
+
+work_dir="${BURROW_OPENBAO_TOFU_DIR:-$ROOT/infra/openbao}"
+plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
+
+usage() {
+  cat <<'EOF'
+Usage: Scripts/openbao-tofu.sh [tofu args...]
+
+Runs OpenTofu for Burrow OpenBao cloud seal and OpenBao API configuration. The
+Vault/OpenBao provider reads VAULT_TOKEN from the environment when managing
+OpenBao mounts, policies, or auth backends.
+
+Examples:
+  Scripts/openbao-tofu.sh init -backend-config=backend.hcl
+  Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars
+
+Local syntax check:
+  Scripts/openbao-tofu.sh init -backend=false
+  Scripts/openbao-tofu.sh validate
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+mkdir -p "$plugin_cache_dir"
+export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
+export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
+
+exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"