Terraform apply/destroy without the confirmation prompt

Applies or destroys infrastructure with -auto-approve, which removes the interactive confirmation Terraform puts there on purpose. Held for approval rather than blocked, because it is the correct flag inside CI. Does NOT match terraform plan, terraform validate, terraform fmt, or terraform apply tf.plan against a saved plan file — a saved plan was already reviewed, which is the whole point of saving it. It cannot tell which workspace or account is selected, because no environment reaches the guard. A global option between the tool and its subcommand is tolerated (terraform -chdir=<dir> apply -auto-approve, --no-color), and an absolute tool path still matches; a flag that itself runs a program is not read. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.