infra(ST-30): allow WIF repository transition

[afaryy]

Summary

• temporarily trust both afaryy/MemoryDirector and sailing-together/MemoryDirector in GitHub Actions WIF
• preserve the existing personal-repo IAM binding with Terraform state move
• add resource-level contract coverage for exact repository, ref, environment and IAM binding keys

Verified plan

• 1 add: sailing-together/MemoryDirector workloadIdentityUser principal
• 2 in-place updates: WIF provider condition and description
• 0 destroy

Validation

• terraform test modules/foundations/bootstrap_identity (1 passed)
• terraform validate bootstrap/identity
• terraform fmt -check and git diff --check

No repository transfer, state changes, credentials, domain change, or Cloud Run ingress change in this PR.