cowork-bot: fix terraform rollback generator correctness and safety

- Empty plans now short-circuit to '# No changes to roll back' instead of
  emitting a header plus a dangerous blanket 'terraform destroy -auto-approve
  && terraform apply -auto-approve' suggestion for a plan with no changes.
- Replacements (create-before-delete / delete-before-create / replace) no
  longer produce contradictory destroy + apply commands for the same
  resource; they revert via apply of the previous config only.
- Pure creates get destroy; pure deletes get an explicit restore comment
  before their apply.
- Added regression tests (tests/test_rollback_safety.py); updated the
  empty-plan edge-case test to assert the new safe behavior. 125/125 green,
  ruff clean.

Author: Coding-Dev-Tools