fix(P10 prep): gitignore terraform/spike/.terraform.lock.hcl (P1-2)

---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: lead-developer
task: T-10.0
type: prerequisite-fix
---/ci---

Phase 09 verify flagged P1-2: terraform/spike/.terraform.lock.hcl was
untracked + not gitignored (the Phase 09 gitignore list covered .terraform/,
tfplan, *.tfstate* but missed the lock file at the spike root). Added
terraform/spike/.terraform.lock.hcl to .gitignore.

Also installed checkov 3.3.8 (D-045: pip install checkov>=3.2,<4) for
Phase 10's Checkov PolicyCheckResult step.

.gitignore

@@ -11,5 +11,6 @@ runner-data/
 .env.secrets
 terraform/bootstrap/.bootstrap_state.json
 terraform/spike/.terraform/
+terraform/spike/.terraform.lock.hcl
 terraform/spike/tfplan
 terraform/spike/*.tfstate*