feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)

---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---

- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
  (PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
  queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
  counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
  (mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
  deletion_protection=false (step 1), then decommission_transform
  (step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
  CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.

Tests: +14 (318 -> 332). All pass.

.github/workflows/deploy.yml

@@ -53,9 +53,13 @@ on:
         type: string
         default: .acdl/contract.yaml
       mode:
-        description: Pipeline mode — full (apply), plan-only, or check-only
+        description: Pipeline mode — full (apply), plan-only, check-only, or decommission
         type: string
         default: full
+      changeRequestId:
+        description: Change request ID (required for decommission mode — validated against CMDB)
+        type: string
+        default: ""
 
 permissions:
   id-token: write
@@ -107,6 +111,13 @@ jobs:
             full) MODE_FLAG="" ;;
             plan-only) MODE_FLAG="--plan-only" ;;
             check-only) MODE_FLAG="--check-only" ;;
+            decommission)
+              if [ -z "${{ inputs.changeRequestId }}" ]; then
+                echo "FAIL: changeRequestId is required for decommission mode"
+                exit 1
+              fi
+              MODE_FLAG="--decommission ${{ inputs.changeRequestId }}"
+              ;;
             *) echo "Unknown mode: ${{ inputs.mode }}"; exit 1 ;;
           esac
           bash platform/scripts/run_platform.sh $MODE_FLAG "${{ inputs.contract }}"