Terraform PR plan is green but main apply uses a different variable set

Reviewers trust the plan output, but production apply behaves differently because the PR stage reads one workspace and tfvars path while the main branch apply uses another.