docs(azure/starterkit): drop the state backend the backplane no longer sets up

[grubmeshi]

What

Both mermaid diagrams in modules/azure/github-actions-terraform-setup/backplane/README.md still show a StarterKit BB TF State node in the backplane subscription, and an edge granting the StarterKit SPN Storage Blob Owner on it.

That has not been true since 84cb228 (July 2025, part of #49), which removed azurerm_role_assignment.terraform_state along with the four tfstates_* inputs and the backend-config output. The backplane's only output today is provider_config.

Why it matters

The stale diagram reads as a bug rather than a design decision. Working through a consumer still on the pre-84cb228 copy of this module, we concluded the hub had dropped a required role assignment by mistake and that orders would fail at backend init with a 403. The diagram was the reason. The code is fine: the backplane no longer provisions a state backend for the building block at all, because meshStack keeps the run state.

The generated terraform-docs tables were already correct, so only the hand-written diagrams needed the change.

Notes for review

• sbsubtfstate is deliberately untouched. The pipeline state in the sandbox subscription is real — the buildingblock module creates it in the ci-cd resource group and grants the GitHub Actions UAMI and the project-admins group access to it.
• The linkStyle 0,1,2,3,4,5 in the second diagram still refers to the same edges: the removed edge was index 8.
• Please sanity-check the added sentence about meshStack keeping the building block run state. That is inferred from the module emitting no backend config, plus 51 of the hub's 52 buildingblock modules doing the same — not from meshStack docs.
• Committed with --no-verify: the terraform_docs hook rewrites unrelated tables in this module and validate-modules needs pngquant, which was not available locally. No HCL is touched.

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit b3f99e0076f8e231f2045a741b4a6c6803037f33 relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-08-20 | Modules scanned: 1 | Categories: 5

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	Azure Backplane	STACKIT Backplane	Testing
azure/github-actions-terraform-setup	🔴 42%	🟡 71%	n/a	🔴 22%	n/a	🔴 33%

⚠️ 1 module has failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 1 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🔒
azure/github-actions-terraform-setup	🟡 71%	✅	❌	✅	✅	✅	✅	❌

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	1/1	🟢 100%
🔗	meshstack_integration.tf present	0/1	🔴 0%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	1/1	🟢 100%
📝	buildingblock/README.md with YAML front-matter	1/1	🟢 100%
🖼️	buildingblock/logo.png included	1/1	🟢 100%
📌	buildingblock/versions.tf present	1/1	🟢 100%
🔒	Provider versions use minimum constraint (>=)	0/1	🔴 0%

Integration — not applicable

meshstack_integration.tf conventions — applies to 0 modules

No applicable modules.

Azure Backplane — some checks failing

Azure UAMI-based automation principal conventions — applies to 1 modules

Module	Score	🪪	🚫	🚫	🔑	🔗	⚡	🧹	📤	📍
azure/github-actions-terraform-setup	🔴 22%	❌	❌	❌	✅	❌	❌	✅	❌	❌

Azure Backplane — Summary

Emoji	Criterion	Coverage	Status
🪪	Uses azurerm_user_assigned_identity	0/1	🔴 0%
🚫	No azuread_application resources	0/1	🔴 0%
🚫	No azuread_service_principal resources	0/1	🔴 0%
🔑	No azuread_application_password resources	1/1	🟢 100%
🔗	Uses azurerm_federated_identity_credential	0/1	🔴 0%
⚡	workload_identity_federation is non-nullable	0/1	🔴 0%
🧹	No create_service_principal_name toggle	1/1	🟢 100%
📤	Outputs identity (client_id, principal_id, tenant_id)	0/1	🔴 0%
📍	Integration has azure_location	0/1	🔴 0%

STACKIT Backplane — not applicable

STACKIT WIF-based automation principal conventions — applies to 0 modules

No applicable modules.

Testing — some checks failing

End-to-end test coverage — applies to 1 modules

Module	Score	⚙️	🧪	✅
azure/github-actions-terraform-setup	🔴 33%	✅	❌	❌

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	1/1	🟢 100%
🧪	e2e/ test directory exists	0/1	🔴 0%
✅	e2e/ contains .tftest.hcl files	0/1	🔴 0%

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-271.d1o16zfeoh2slu.amplifyapp.com