Terraform workflow: remove resources without destroying with removed blocks

# Terraform workflow: remove resources without destroying with removed blocks

## When

A resource leaves Terraform management but must keep existing: handoff to another team, migration to another IaC tool, or decomposing a monolith config.

## Steps

1. Replace the resource block with a removed block:
   ```
   removed {
     from = aws_instance.legacy
     lifecycle {
       destroy = false
     }
   }
   ```
   `destroy = false` is the load-bearing line: without it, Terraform destroys the object.
2. `terraform plan`. The plan must show the resource being forgotten, with NO destroy. If it shows a destroy, stop: the lifecycle setting is wrong or in the wrong place.
3. `terraform apply`. Verify the object still exists in the console and no longer appears in `terraform state list`.
4. Keep the removed block as documentation, or delete it once the handoff is complete and everyone has applied past it.

## Rules for agents

1. Default `removed` without the lifecycle block destroys. This is the single most dangerous default in the removal workflow; double-check the block every time.
2. For resources with dependencies: removing a resource others reference breaks their config. Update or remove the references in the same change.
3. Data loss check: if the object holds state (database, bucket with data), confirm the new owner/management before untracking. Untracked and unowned is how data gets deleted by the next person who finds it.
4. Prefer removed blocks over `terraform state rm`: the block is in version control, reviewed, and replayable. state rm is invisible to the next reader.