Guard cluster worker var loading

bootstrap/cluster/main.tf

@@ -380,10 +380,26 @@ EOT
   ]
 }
 
+resource "null_resource" "worker_nodes_required" {
+  triggers = {
+    worker_count = tostring(length(var.worker_nodes))
+  }
+
+  lifecycle {
+    precondition {
+      condition     = var.allow_empty_worker_nodes || length(var.worker_nodes) > 0
+      error_message = "worker_nodes is empty. Pass -var-file=/path/to/.lab/cluster-workers.auto.tfvars.json or set allow_empty_worker_nodes=true for an intentional control-plane-only cluster."
+    }
+  }
+}
+
 resource "null_resource" "kubeadm_worker" {
   for_each = var.worker_nodes
 
-  depends_on = [data.external.kubeadm_join_command]
+  depends_on = [
+    data.external.kubeadm_join_command,
+    null_resource.worker_nodes_required,
+  ]
 
   triggers = {
     node_name                            = each.value.node_name

bootstrap/cluster/variables.tf

@@ -63,6 +63,11 @@ variable "worker_nodes" {
   default = {}
 }
 
+variable "allow_empty_worker_nodes" {
+  type    = bool
+  default = false
+}
+
 variable "worker_node_labels" {
   type = map(map(string))