fix: Scope plan storage AWS credentials to prevent Atmos auth interference

[milldr]

What

Use output-credentials: true mode for plan storage credential configuration and pass credentials explicitly via step-level env: vars to the plan storage steps.

Why

When using Atmos auth for Terraform operations (instead of the terraform-apply-role setting), the AWS credentials configured for plan storage (S3/DynamoDB access) were persisting in environment variables and taking precedence over Atmos' authentication mechanism.

This caused authentication failures when:

1. terraform-apply-role was not configured in gitops settings
2. Atmos auth was expected to handle role assumption for the target account
3. Plan storage credentials remained in AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN

Changes

• Add output-credentials: true to plan storage credential configuration step
• Add step id plan-storage-credentials for referencing credential outputs
• Pass AWS credentials explicitly via env: to "Retrieve Plan" and "Retrieve Lockfile" steps
• Rename second credential configuration step to "Configure Apply AWS Credentials" for clarity

[jamengual]

will this output the ENV var values to the console?

[milldr]

No, it won't expose the credential values. The aws-actions/configure-aws-credentials action automatically masks the credential outputs, so they appear as *** if they ever show up in output.