refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

pipelines/README.md

@@ -8,8 +8,8 @@ ACDL uses declarative pipeline contracts (YAML) as the single source of truth. B
 
 | Pipeline | File | Stages | Triggers |
 | --- | --- | --- | --- |
-| ACDL CI | `ci.yaml` | `lint`, `test`, `check-only` | push/PR to `main` |
-| ACDL Deploy | `deploy.yaml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
+| ACDL CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` |
+| ACDL Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
 
 ## How to Write a Pipeline
 
@@ -21,13 +21,13 @@ ACDL uses declarative pipeline contracts (YAML) as the single source of truth. B
 
 1. Create byte-identical workflow YAMLs in `.gitea/workflows/<name>.yml` and `.github/workflows/<name>.yml`.
 2. Both workflows must implement the same stages, commands, triggers, and runner declared in the contract.
-3. `scripts/run_ci.sh` mirrors `ci.yaml` locally so the same stages run without a forge.
+3. `scripts/run_ci.sh` mirrors `ci.yml` locally so the same stages run without a forge.
 4. Consumer repos reference the deploy pipeline via `uses: acdl/.github/workflows/deploy.yml@vX.Y`.
 
 ## Dependencies
 
-- `scripts/run_ci.sh` — local CI mirror that runs the `ci.yaml` stages.
-- `scripts/run_platform.sh` — platform pipeline runner that implements the `deploy.yaml` stages.
+- `scripts/run_ci.sh` — local CI mirror that runs the `ci.yml` stages.
+- `scripts/run_platform.sh` — platform pipeline runner that implements the `contract.yml` stages.
 - Workflow YAMLs in `.gitea/workflows/` and `.github/workflows/`.
 - Schemas in `schemas/` (`pipeline.schema.json`, `deploy-pipeline.schema.json`).
 
@@ -37,7 +37,7 @@ ACDL uses declarative pipeline contracts (YAML) as the single source of truth. B
 
 ## Adding a New Pipeline
 
-1. Create `pipelines/<name>.yaml` using the structure above.
+1. Create `pipelines/<name>.yml` using the structure above.
 2. Create or extend the schema in `schemas/` for the new pipeline shape.
 3. Create byte-identical workflow YAMLs in `.gitea/workflows/<name>.yml` and `.github/workflows/<name>.yml`.
 4. Extend `scripts/run_ci.sh` if a local mirror of the new pipeline is needed.

pipelines/contract.yml

@@ -10,9 +10,10 @@
 #   validate-change-request -> disable-deletion-protection (HITL SRE) ->
 #   zero-counts (HITL SRE) -> confirm-decommission
 #
-# Consumers reference this pipeline via `uses: acdl/pipelines/deploy.yaml@v1`
-# in their contract YAML. The platform (scripts/run_platform.sh) implements
-# these stages.
+# This file is the declarative pipeline spec (a contract, not an executable
+# workflow). The executable workflow is .github/workflows/deploy.yml
+# (GitHub Actions) / .gitea/workflows/deploy.yml (Gitea Actions), which
+# implements these stages by invoking scripts/run_platform.sh.
 #
 # Validated against schemas/deploy-pipeline.schema.json.