Exercise 1: What terraform.workspace Isolates, and Why the Wrong Workspace Is Still Dangerous — Possible Solution
====================================================================

`terraform.workspace` isolates exactly one thing: STATE. Each named
workspace gets its own separate state file within the same backend --
so `terraform.workspace` selected as "dev" reads and writes a
different state file than the same command run with "prod" selected.
That's the entire scope of what changes.

What it does NOT isolate: the CONFIGURATION (every workspace runs the
exact same `.tf` files), the BACKEND (every workspace's state lives in
the same S3 bucket/DynamoDB table, or whatever backend is configured),
and the PROVIDER CREDENTIALS (every workspace authenticates to the
real cloud provider using the exact same credentials the current shell
session has configured). None of these three things know or care which
workspace happens to be currently selected.

This is exactly why running `apply` in the wrong workspace is still
genuinely dangerous: if a team member intends to test something in
"dev" but is actually still sitting in the "prod" workspace from an
earlier session, running `apply` doesn't fail, doesn't warn, and
doesn't get redirected somewhere safe -- it executes against the SAME
real infrastructure account, using the SAME real provisioning
credentials, that "prod" always uses, simply because state was the
only thing that ever differed between the two workspaces in the first
place. Nothing about the credentials or provider connection itself
changes based on workspace selection, so a mistaken workspace doesn't
protect against a mistaken apply the way a genuinely separate
environment (different credentials entirely) would.

WHY THIS WORKS AS AN ANSWER
------------------------------
This lists all three things workspaces do NOT isolate (configuration,
backend, credentials) rather than just state's isolation alone, and
connects that gap directly to the concrete danger (a wrong-workspace
apply hitting real prod credentials with nothing to stop it).