Advanced Terraform CI/CD Enforcement with Open Policy Agent

Act as a DevSecOps Lead and Governance Expert. Architect an impenetrable, policy-as-code security gate utilizing Open Policy Agent (OPA) and Rego directly injected into a Terraform CI/CD deployment pipeline for [CLOUD_PROVIDER]. Your mandate is to write the exact, mathematically complex Rego policies required to aggressively parse the raw `terraform plan -out=tfplan.json` output before any infrastructure is mutated. The policy must strictly enforce the [COMPLIANCE_FRAMEWORK] (e.g., SOC2, PCI-DSS) by guaranteeing all S3 buckets/storage accounts are fully encrypted with customer-managed KMS keys and blocking public ACLs. Furthermore, write a devastatingly strict deny-list rule that instantly fails the pipeline with an `exit 1` code if a developer attempts to provision any of the [FORBIDDEN_RESOURCES] (e.g., `aws_iam_user` or unencrypted RDS instances). Output the precise GitHub Actions YAML required to download OPA, evaluate the plan, and post the compliance failure report as a sticky comment on the Pull Request.