feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)

---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---

- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
  (PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
  queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
  counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
  (mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
  deletion_protection=false (step 1), then decommission_transform
  (step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
  CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.

Tests: +14 (318 -> 332). All pass.

core/contract_resolver.py

@@ -281,6 +281,27 @@ def resolve_l2(contract, registry, repo_root):
     return stack_instance
 
 
+def decommission_transform(stack_instance):
+    """REQ-92: Transform a resolved stack instance for decommission.
+
+    Sets all scalable counts to 0 and deletion_protection to false on
+    every resource. Used by the decommission pipeline mode after the
+    first step (disable deletion protection) has been applied.
+    """
+    for res in stack_instance.get("resources", []):
+        if "nfrs" not in res:
+            res["nfrs"] = {}
+        res["nfrs"]["deletion_protection"] = False
+        inputs = res.get("inputs", {})
+        if "desired_count" in inputs:
+            inputs["desired_count"] = 0
+        if "min_capacity" in inputs:
+            inputs["min_capacity"] = 0
+        if "max_capacity" in inputs:
+            inputs["max_capacity"] = 0
+    return stack_instance
+
+
 def resolve(contract_path, repo_root=None):
     """Resolve a consumer contract to a Target Stack instance.