feat(P4): Nova rebrand — AWS resource migration (REQ-163)

Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB,
Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy,
state bucket, ALB, VPC/subnet names). Lambda default table names → nova-*
(D-111). State bucket backend → nova-tfstate (-migrate-state documented).
New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback).
New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default).
acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures
updated; terraform validate + pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 4
milestone: v1.15
status: execute
---/ci---

core/lambda/contract_ingestor.py

@@ -2,7 +2,7 @@
 
 Invoked via a Function URL (IAM auth) by consumer pipelines (one-way
 communication, D-051). Accepts { consumerRepo, contractId, contract,
-environment, action } and writes contracts to DynamoDB table acdl-contracts
+environment, action } and writes contracts to DynamoDB table nova-contracts
 (PK consumerRepo, SK contractId#submittedAt).
 
 The report_error action (D-055) creates a GitHub issue on the platform repo
@@ -22,10 +22,10 @@ import urllib.parse
 
 import boto3
 
-TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "acdl-contracts")
-CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
-GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "acdl/github-token")
-PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "acdl/acdl")
+TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "nova-contracts")
+CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "nova-change-requests")
+GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "nova/github-token")
+PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "nova/acdl")
 # P1-9: Forge-agnostic API base URL. Defaults to GitHub; set GITHUB_API_BASE
 # to a Gitea API root (e.g. https://git.cloudinit.dev/api/v1) for Gitea.
 GITHUB_API_BASE = os.environ.get("GITHUB_API_BASE", "https://api.github.com")
@@ -243,7 +243,7 @@ def _validate_caller_identity(event, payload):
     error length. The ABAC reliance is documented here: the Function URL IAM
     identity does not expose principal tags in the event, so full enforcement
     of consumerRepo ownership is at the IAM layer (ABAC via
-    aws:PrincipalTag/acdl:owner). This function validates format only, not
+     aws:PrincipalTag/nova:owner). This function validates format only, not
     ownership.
     """
     identity = event.get("requestContext", {}).get("identity", {})
@@ -279,7 +279,7 @@ def _validate_caller_identity(event, payload):
 def _validate_change_request(payload):
     """REQ-93: Validate a change request ID against the CMDB (DynamoDB).
 
-    Queries the acdl-change-requests table for the given changeRequestId.
+    Queries the nova-change-requests table for the given changeRequestId.
     Returns the CR details if status is 'approved' and the consumerRepo matches.
     Raises ValueError if the CR is not found, not approved, or the repo doesn't match.
     """