Keep .terraform.lock.hcl for reproducible provider pins; gitignore state files and the .terraform/ working directory.