Bump the Cloudflare provider from 5.24.0 to 5.28.0 while automatic updates cannot run #22

🤖 Generated by the Agentic Engineer

Evidence

• versions.tf pins the Cloudflare provider at = 5.24.0. The OpenTofu registry's newest release is 5.28.0 (released 2026-10-13); 5.25, 5.26 and 5.27 came in between.
• Automatic updates (Automate Cloudflare provider updates with a tool that supports OpenTofu lock files #3) cannot start until the organization's Renovate app covers this repository (Renovate is configured in four repositories it has never run in monorepo#4098, maintainer-only).
• Upstream release notes for 5.27 and 5.28 mark breaking changes. The ones that touch resource types this configuration uses: account_token permission-group metadata became typed fields (5.27), and dns_record now defaults include_shadow_metadata to false on import and refresh (5.27/5.28). This configuration lists permission groups but does not read their metadata.

Why now

Nothing has been imported yet, so a schema change costs nothing to absorb today. After the first import, every provider bump has to be checked against a live no-destroy plan.

Expected behaviour

The pin and .terraform.lock.hcl move to 5.28.0 through the OpenTofu registry, and scripts/test.sh passes.

Acceptance criteria

• versions.tf pins = 5.28.0, and the lock file records registry.opentofu.org/cloudflare/cloudflare 5.28.0 with hashes for every platform CI and operators use.
• scripts/test.sh (format, init, validate) passes locally and in CI.
• The PR states which breaking changes were checked against main.tf and why none applies.

Out of scope

Any plan or apply against live resources.

Part of #21