feat(P4): transparent terraform + feature flags + run_platform.sh split (REQ-233..238)

Create run_codegen.sh (pre-TF: env check, validate, resolve, adapt).
Create run_postapply.sh (post-TF: Checkov, confidence, HITL, outbox, SSM, uptime).
Add variable 'enabled' (bool, default true) + count=var.enabled?1:0 to all 12
L1 modules (alb, cloudfront, ecr, ecs-cluster, ecs-service, iam-role, kms-key,
rds, s3, uptime, vpc, waf). Fix all cross-resource references with [0] indexing.
Update interface.json for all modules to declare 'enabled' input.
Fix stale artifact path /tmp/acdl_platform_run_v18 → /tmp/nova_platform_run (REQ-238).
run_platform.sh remains as backward-compat shim for local-dev usage.

---ci---
project: acdl
phase: 4
milestone: v1.20
status: execute
requirements: [REQ-233, REQ-234, REQ-235, REQ-236, REQ-237, REQ-238]
---/ci---

modules/l1/vpc/interface.json

@@ -24,6 +24,11 @@
       "type": "string",
       "description": "AWS region the VPC is created in.",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -57,24 +62,44 @@
     {
       "type": "aws:ec2:vpc",
       "description": "The VPC itself.",
-      "inputs": ["cidr", "name"],
-      "outputs": ["vpc_id"]
+      "inputs": [
+        "cidr",
+        "name"
+      ],
+      "outputs": [
+        "vpc_id"
+      ]
     },
     {
       "type": "aws:ec2:subnet",
       "description": "One subnet per availability zone (azs split on comma).",
-      "inputs": ["cidr", "az", "vpc_id", "name"],
-      "outputs": ["subnet_ids"]
+      "inputs": [
+        "cidr",
+        "az",
+        "vpc_id",
+        "name"
+      ],
+      "outputs": [
+        "subnet_ids"
+      ]
     },
     {
       "type": "aws:ec2:routetable",
       "description": "Route table bound to the VPC with an internet gateway + default route.",
-      "inputs": ["vpc_id"],
+      "inputs": [
+        "vpc_id"
+      ],
       "outputs": []
     }
   ],
   "intra_refs": [
-    {"from": "aws:ec2:subnet.vpc_id", "to": "aws:ec2:vpc.vpc_id"},
-    {"from": "aws:ec2:routetable.vpc_id", "to": "aws:ec2:vpc.vpc_id"}
+    {
+      "from": "aws:ec2:subnet.vpc_id",
+      "to": "aws:ec2:vpc.vpc_id"
+    },
+    {
+      "from": "aws:ec2:routetable.vpc_id",
+      "to": "aws:ec2:vpc.vpc_id"
+    }
   ]
-}
+}

modules/l1/vpc/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_vpc" "this" {
+  count = var.enabled ? 1 : 0
   cidr_block = local.cidr_block
   tags = {
     Name = local.name_tag
@@ -11,7 +12,7 @@ resource "aws_vpc" "this" {
 
 resource "aws_subnet" "this" {
   count             = length(local.az_list)
-  vpc_id            = aws_vpc.this.id
+  vpc_id            = aws_vpc.this[0].id
   cidr_block        = local.subnet_cidrs[count.index]
   availability_zone = local.az_list[count.index]
   tags = {
@@ -20,17 +21,19 @@ resource "aws_subnet" "this" {
 }
 
 resource "aws_internet_gateway" "this" {
-  vpc_id = aws_vpc.this.id
+  count = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
   tags = {
     Name = "${local.name_tag}-igw"
   }
 }
 
 resource "aws_route_table" "this" {
-  vpc_id = aws_vpc.this.id
+  count = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
   route {
     cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.this.id
+    gateway_id = aws_internet_gateway.this[0].id
   }
   tags = {
     Name = "${local.name_tag}-rt"
@@ -40,5 +43,5 @@ resource "aws_route_table" "this" {
 resource "aws_route_table_association" "this" {
   count          = length(local.az_list)
   subnet_id      = aws_subnet.this[count.index].id
-  route_table_id = aws_route_table.this.id
+  route_table_id = aws_route_table.this[0].id
 }

modules/l1/vpc/terraform/outputs.tf

@@ -1,5 +1,5 @@
 output "vpc_id" {
-  value       = aws_vpc.this.id
+  value       = aws_vpc.this[0].id
   description = "The VPC id."
 }
 

modules/l1/vpc/terraform/variables.tf

@@ -21,3 +21,9 @@ variable "region" {
   description = "AWS region (provider-level; not a resource arg)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}