refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

README.md

@@ -26,9 +26,9 @@ There are two kinds of repository in the ACDL model:
   A **consumer never clones it.**
 - **Consumer repo (yours).** A consumer repo contains only:
   1. **Its application code** — the service or site being deployed.
-  2. **One or more contracts** — small YAML files at `.acdl/contract.yaml`
-     that reference the central pipeline, name a module, select an
-     environment, and supply module-specific inputs.
+  2. **One or more contracts** — small YAML files at `.acdl/contract.yml`
+     that declare infrastructure (one or more modules by name + version),
+     select an environment, and supply module-specific inputs.
   3. **One or more CI definitions** — thin `.github/workflows/*.yml` files
      that `uses:` the central reusable deploy workflow, pointing at the
      appropriate environment + contract.
@@ -93,9 +93,9 @@ intent via a contract; the platform delivers the deployment through the
 same contract schema, the same policy envelope, and the same evidence
 stream.
 
-Consumers have their own repos and consume ACDL by referencing `uses:` the
-central pipeline definitions. A consumer declares a contract (module +
-environment + inputs); the platform resolves it to a stack instance,
+Consumers have their own repos and consume ACDL by writing a contract that
+declares infrastructure. A consumer declares a contract (id + name +
+environment + infrastructure); the platform resolves it to a stack instance,
 compiles it, runs security + policy checks, computes a confidence signal,
 writes an evidence event to the audit outbox, and applies the
 infrastructure.
@@ -104,7 +104,7 @@ infrastructure.
 
 ```mermaid
 flowchart TD
-    A["consumer contract<br/>(uses + module + environment + inputs)"] --> B
+    A["consumer contract<br/>(id + name + environment + infrastructure)"] --> B
     B["schema validation<br/>(contract schema)"] --> C
     C["resolve to Target Stack<br/>(contract resolver)"] --> D
     D["security checks<br/>(adapter)"] --> E
@@ -155,7 +155,7 @@ ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
 # 3. Run the full platform pipeline (contract -> environment check -> stack ->
 #    adapter -> security checks -> infrastructure plan -> policy checks ->
 #    confidence -> evidence event -> apply). Output is streamed to stdout.
-bash scripts/run_platform.sh contracts/static-assets.yaml
+bash scripts/run_platform.sh contracts/static-assets.yml
 # Expected: "=== PLATFORM E2E OK ==="
 
 # Or plan-only (contract -> stack -> adapter -> infrastructure plan; no
@@ -189,7 +189,7 @@ bash scripts/run_ci.sh
 ### CI/CD pipelines
 
 The CI/CD pipeline is defined by a **central pipeline contract** — a
-declarative YAML instance (`pipelines/ci.yaml`) validated against a JSON
+declarative YAML instance (`pipelines/ci.yml`) validated against a JSON
 Schema (`schemas/pipeline.schema.json`). Both platform-runner workflows
 implement the same contract:
 
@@ -212,13 +212,13 @@ bash scripts/run_ci.sh --quiet    # suppress per-stage banners
 ### Reusable deploy workflow
 
 The deployment pipeline is defined by a **central deployment pipeline
-contract** (`pipelines/deploy.yaml`, validated against
+contract** (`pipelines/contract.yml`, validated against
 `schemas/deploy-pipeline.schema.json`) and exposed to consumer repos as a
 **reusable workflow**:
 
 - `.github/workflows/deploy.yml` — GitHub Actions (production)
 
-The workflow implements the same stages as `pipelines/deploy.yaml`
+The workflow implements the same stages as `pipelines/contract.yml`
 (validate-contract → resolve-stack → security checks → infrastructure plan
 → policy checks → confidence → evidence event → apply). A consumer repo
 invokes the reusable workflow via a **versioned tag** (floating MAJOR +
@@ -257,7 +257,7 @@ across all modules; `static-assets` is the worked example.
 |------|---------|--------|
 | `core/` | Platform code: contract resolver, confidence signal, outbox writer, environment check, environments, separation of duties, HITL/ledger designs | active |
 | `schemas/` | JSON Schemas: stack, contract, PolicyCheckResult, pipeline contract, deploy pipeline contract (draft 2020-12) | active |
-| `pipelines/` | Central pipeline contracts: `ci.yaml` (CI), `deploy.yaml` (deployment) | active |
+| `pipelines/` | Central pipeline contracts: `ci.yml` (CI), `contract.yml` (deployment) | active |
 | `adapters/` | Angine adapters — the engine adapter (the only engine-specific code per §12) + the policy adapter | active |
 | `terraform/` | State backend (S3 + DynamoDB) + platform TF (`terraform/spike/`) + bootstrap scripts (`terraform/bootstrap/`) | active |
 | `modules/` | Primitives + modules + `registry.json`. Primitives: s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds. Modules: microservice, static-assets. Each module has a `examples/` directory with validated contract examples | active |