feat(P4): transparent terraform + feature flags + run_platform.sh split (REQ-233..238)

Create run_codegen.sh (pre-TF: env check, validate, resolve, adapt).
Create run_postapply.sh (post-TF: Checkov, confidence, HITL, outbox, SSM, uptime).
Add variable 'enabled' (bool, default true) + count=var.enabled?1:0 to all 12
L1 modules (alb, cloudfront, ecr, ecs-cluster, ecs-service, iam-role, kms-key,
rds, s3, uptime, vpc, waf). Fix all cross-resource references with [0] indexing.
Update interface.json for all modules to declare 'enabled' input.
Fix stale artifact path /tmp/acdl_platform_run_v18 → /tmp/nova_platform_run (REQ-238).
run_platform.sh remains as backward-compat shim for local-dev usage.

---ci---
project: acdl
phase: 4
milestone: v1.20
status: execute
requirements: [REQ-233, REQ-234, REQ-235, REQ-236, REQ-237, REQ-238]
---/ci---

modules/l1/waf/interface.json

@@ -31,6 +31,11 @@
       "type": "string",
       "description": "AWS region (CloudFront-scoped WAF is always us-east-1; the adapter ignores this for cloudfront scope).",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -60,8 +65,15 @@
     {
       "type": "aws:wafv2:webacl",
       "description": "WAFv2 Web ACL with managed rules.",
-      "inputs": ["name", "scope", "default_action", "rules"],
-      "outputs": ["web_acl_arn"]
+      "inputs": [
+        "name",
+        "scope",
+        "default_action",
+        "rules"
+      ],
+      "outputs": [
+        "web_acl_arn"
+      ]
     }
   ]
-}
+}