feat: TerraformCheck construct (check blocks with scoped data sources)

[so0k]

Description

Terraform ≥ 1.5 and OpenTofu ≥ 1.6 support top-level check blocks: one or more assert { condition, error_message } plus an optional scoped data source only referenceable inside the check. Failures are warnings for plan/apply (continuous validation), and errors under terraform test.

CDKTN has no construct for this — there is no check key anywhere in packages/cdktn/src. The only path today is untyped:

stack.addOverride("check.health", { assert: [{ condition: "${...}", error_message: "..." }] });

which has no logical-ID allocation, no token-aware typing, no scoped data source support and no ITerraformAddressable address.

Proposal

A TerraformCheck element synthesizing under the top-level check key (JSON + HCL):

new TerraformCheck(stack, "health", {
  // optional scoped data source
  assert: [{ condition: Op.eq(probe.statusCode, 200), errorMessage: "endpoint must answer 200." }],
});

• assert: TerraformCondition[] (reuse terraform-conditions.ts), at least one required.
• Scoped data source: accept a data source constructed in the check's scope and render it inside the check block instead of top-level data.
• Bare address check.<friendlyUniqueId> for tooling (expect_failures in test files).
• No targetVersions gate needed: the default floor (terraform >=1.5.7 / opentofu >=1.6.0) already covers it.

References

• cdktn-planning RFC 09 (terraform test support): probe sweep confirms expect_failures = [check.<name>] and "failing check fails the run" on every Terraform 1.6.6–1.16.3 and OpenTofu 1.6.0–1.12.6 release. Not a hard blocker for that RFC (overrides work), but needed to make check blocks first-class test targets.