fix(P28): WAF nested rules + default_action + resolver outputs (P1-4, P1-5, P1-7)

---ci---
project: acdl
phase: 28
milestone: v1.8
status: execute
---/ci---

P1-4: WAF custom rules now emit nested `rules { ... }` blocks per rule
instead of `rules = [...]` attribute syntax (invalid HCL).
P1-5: WAF default_action input is honored (allow/block) instead of
hardcoding `allow {}`. Default is `allow` when absent (backward compat).
P1-7: L2 composition outputs[] array is now processed by resolve_l2().
The resolver builds stack.outputs from the composition outputs wires.
The adapter emits `output` blocks from stack.outputs.

Tests: +10 (275 -> 285). All pass. run_platform.sh --check-only green.

core/contract_resolver.py

@@ -232,6 +232,37 @@ def resolve_l2(contract, registry, repo_root):
         "resources": resources,
     }
 
+    # P1-7: Process the composition's outputs[] array to build stack.outputs.
+    # Each output wire: {"from": "<childId>.outputs.<name>", "to": "stack.outputs.<outName>"}
+    # The child_outputs map (childId -> {outputName: resourceId}) resolves
+    # the source to a resource id, which the adapter uses to emit
+    # `output "<outName>" { value = aws_<type>.<resourceId>.<attr> }`.
+    stack_outputs = {}
+    for out_wire in composition.get("outputs", []):
+        from_expr = out_wire.get("from", "")
+        to_expr = out_wire.get("to", "")
+        # Parse "to": "stack.outputs.<outName>"
+        to_parts = to_expr.split(".")
+        if len(to_parts) != 3 or to_parts[1] != "outputs":
+            continue
+        out_name = to_parts[2]
+        # Parse "from": "<childId>.outputs.<name>"
+        from_parts = from_expr.split(".")
+        if len(from_parts) != 3 or from_parts[1] != "outputs":
+            continue
+        src_child = from_parts[0]
+        src_output = from_parts[2]
+        # Resolve the source resource id from child_outputs
+        child_out_map = child_outputs.get(src_child, {})
+        src_resource_id = child_out_map.get(src_output, src_child)
+        stack_outputs[out_name] = {
+            "type": "string",
+            "from": src_resource_id,
+            "output": src_output,
+        }
+    if stack_outputs:
+        stack_instance["outputs"] = stack_outputs
+
     return stack_instance