Guard repository and membership deletes

[galargh]

Summary

Add guarded allow-destroy paths so repository and membership deletes are planned in read-allow-destroy and applied in write-allow-destroy while committed Terraform keeps prevent_destroy enabled.

Why do you need this?

This lets intentional repo/member removals proceed only after extra environment approval, while normal plans/applies and rogue workflow paths continue to fail closed.

What else do we need to know?

The new environments must define ALLOW_DESTROY_GUARD=true and should use stricter reviewer protections.

DRI: myself

Reviewer's Checklist

• It is clear where the request is coming from (if unsure, ask)
• All the automated checks passed
• The YAML changes reflect the summary of the request
• The Terraform plan posted as a comment reflects the summary of the request