refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

modules/l1/waf/README.md

@@ -69,32 +69,36 @@ pipeline validates them against `schemas/contract.schema.json`.
 
 A minimal deployment:
 
-[`examples/simple.yaml`](examples/simple.yaml)
+[`examples/simple.yml`](examples/simple.yml)
 ```yaml
-# Simple WAF with managed rules only
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: waf
 environment: dev
-inputs:
-  name: my-waf
-  region: us-east-1
+id: waf
+infrastructure:
+  waf:
+    inputs:
+      name: my-waf
+      region: us-east-1
+    version: 1.0.0
+name: waf-firewall
 ```
 
 ### Complex
 
 A production deployment with optional inputs:
 
-[`examples/complex.yaml`](examples/complex.yaml)
+[`examples/complex.yml`](examples/complex.yml)
 ```yaml
-# Complex WAF with rate limiting + geo blocking (custom rules)
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: waf
 environment: dev
-inputs:
-  name: my-production-waf
-  scope: cloudfront
-  default_action: allow
-  region: us-east-1
+id: waf
+infrastructure:
+  waf:
+    inputs:
+      default_action: allow
+      name: my-production-waf
+      region: us-east-1
+      scope: cloudfront
+    version: 1.0.0
+name: waf-firewall
 ```
 
 ## Versioning

modules/l1/waf/examples/complex.yaml

@@ -1,9 +0,0 @@
-# Complex WAF with rate limiting + geo blocking (custom rules)
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: waf
-environment: dev
-inputs:
-  name: my-production-waf
-  scope: cloudfront
-  default_action: allow
-  region: us-east-1

modules/l1/waf/examples/complex.yml

@@ -0,0 +1,12 @@
+# Complex WAF with rate limiting + geo blocking (custom rules)
+environment: dev
+id: waf
+infrastructure:
+  waf:
+    inputs:
+      default_action: allow
+      name: my-production-waf
+      region: us-east-1
+      scope: cloudfront
+    version: 1.0.0
+name: waf-firewall

modules/l1/waf/examples/simple.yaml

@@ -1,7 +0,0 @@
-# Simple WAF with managed rules only
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: waf
-environment: dev
-inputs:
-  name: my-waf
-  region: us-east-1

modules/l1/waf/examples/simple.yml

@@ -0,0 +1,10 @@
+# Simple WAF with managed rules only
+environment: dev
+id: waf
+infrastructure:
+  waf:
+    inputs:
+      name: my-waf
+      region: us-east-1
+    version: 1.0.0
+name: waf-firewall