Expose the trigger tag as a run environment variable (parity with branch / SHA)

Workaround

Created a dedicated Spacelift API keypair and a login policy granting it read access to the relevant stacks then attaching the credentials to those stacks via a context. A before_init hook exchanges the keypair for a JWT via the apiKeyUser mutation, queries stack(id) { run(id) { commit { tag } } } for the current run, and writes the value into a *.auto.tfvars file so it survives the hook subshell into the plan/apply stages. The auto-injected run-scoped SPACELIFT_API_TOKEN can't be used here as it's denied on Stack/Run queries so a long-lived API key is mandatory.

Problem

Set a Terraform version variable to the OCI tag pushed by a paired CI build