build(deps): bump terraform to 1.15.9

[KazuyaMiyagi]

What are you trying to accomplish?

Bump the bundled Terraform version from 1.15.3 to 1.15.9.

The bundled version has been 1.15.3 since #15055 was merged on 2026-05-29, while the latest Terraform release is 1.15.9 (released 2026-08-19).

Where this bites: in a directory whose .terraform.lock.hcl needs its module sources installed before terraform providers lock can run, the lockfile updater falls back to terraform init (terraform/lib/dependabot/terraform/file_updater.rb:252 and :319). If the repository's required_version excludes the bundled version, that init fails and the provider update is abandoned before Dependabot ever evaluates it. A repository tracking the latest release would see, for example:

Error: Unsupported Terraform Core version

  on main.tf line 2, in terraform:
   2:   required_version = "1.15.9"

This configuration does not support Terraform version 1.15.3. To proceed,
either choose another supported Terraform version or update this version
constraint. Version constraints are normally set for good reason, so updating
the constraint may lead to other errors or unexpected behavior.

This is the same failure mode as #15038, fixed at the time by #15055, and as #14062 before it. It recurs on every Terraform release, since the updater runs a fixed Terraform version regardless of the repository's constraint (#5797).

Anything you want to highlight for special attention from reviewers?

Only terraform/Dockerfile changes: the version and the two checksums. Both checksums come from the official SHA256SUMS for 1.15.9, using the commands documented in the comment above each ARG:

$ curl "https://releases.hashicorp.com/terraform/1.15.9/terraform_1.15.9_SHA256SUMS" | grep "terraform_1.15.9_linux_amd64.zip"
76edd0b22d2f27d3d2e097cd793209646f719cf60f02ff3af626b07361137da1  terraform_1.15.9_linux_amd64.zip
$ curl "https://releases.hashicorp.com/terraform/1.15.9/terraform_1.15.9_SHA256SUMS" | grep "terraform_1.15.9_linux_arm64.zip"
0afa6c29f61ca5ea270e950e43e50ecf2418b598507bf580e8ae76e1e6699b19  terraform_1.15.9_linux_arm64.zip

The branch name still refers to 1.15.8, the latest release when this PR was opened.

How will you know you've accomplished your goal?

arm64-build builds the image, exercising both the download URL and the sha256sum -c verification, so a successful build confirms that the version and the checksums are correct.

Checklist

• I have run the complete test suite to ensure all tests and linters pass. — run in CI on this PR: ci (terraform, terraform, terraform), Lint and Sorbet are green
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality. — a pinned version has no test to add, so the change is covered by arm64-build and by e2e (terraform, terraform, smoke-terraform.yaml, 2f32ca5), which runs an end-to-end Terraform update against an image built with 1.15.9. Both are green
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Updates the bundled Terraform runtime to support repositories requiring Terraform 1.15.8.

Changes:

• Bumps Terraform from 1.15.3 to 1.15.8.
• Updates AMD64 and ARM64 checksums.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[KazuyaMiyagi]

Filed #15969 for the failure this unblocks: in a directory that declares a module, terraform providers lock is retried behind terraform init, and init is the command that enforces required_version — so provider updates are dropped there while directories without modules keep updating. In a multi-directory grouped configuration the affected directory is simply absent from the PR, with no error surfaced.

That issue also includes a two-file reproduction that needs only the released updater image, and confirms that the same directory succeeds once the image carries 1.15.9.