feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)

---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---

- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
  (PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
  queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
  counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
  (mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
  deletion_protection=false (step 1), then decommission_transform
  (step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
  CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.

Tests: +14 (318 -> 332). All pass.

core/lambda/contract_ingestor.py

@@ -22,6 +22,7 @@ import urllib.parse
 import boto3
 
 TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "acdl-contracts")
+CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
 GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "acdl/github-token")
 PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "acdl/acdl")
 # P1-9: Forge-agnostic API base URL. Defaults to GitHub; set GITHUB_API_BASE
@@ -244,6 +245,52 @@ def _validate_caller_identity(event, payload):
         raise ValueError(f"invalid consumerRepo format: {payload_repo!r}")
 
 
+def _validate_change_request(payload):
+    """REQ-93: Validate a change request ID against the CMDB (DynamoDB).
+
+    Queries the acdl-change-requests table for the given changeRequestId.
+    Returns the CR details if status is 'approved' and the consumerRepo matches.
+    Raises ValueError if the CR is not found, not approved, or the repo doesn't match.
+    """
+    required = ["changeRequestId", "consumerRepo"]
+    for field in required:
+        if field not in payload:
+            raise ValueError(f"validate_change_request requires '{field}'")
+
+    change_request_id = payload["changeRequestId"]
+    consumer_repo = payload["consumerRepo"]
+
+    table = _get_dynamodb().Table(CHANGE_REQUESTS_TABLE)
+    response = table.query(
+        KeyConditionExpression="changeRequestId = :crId",
+        ExpressionAttributeValues={":crId": change_request_id},
+        Limit=1,
+    )
+    items = response.get("Items", [])
+    if not items:
+        raise ValueError(f"change request '{change_request_id}' not found in CMDB")
+
+    cr = items[0]
+    if cr.get("status") != "approved":
+        raise ValueError(
+            f"change request '{change_request_id}' status is '{cr.get('status')}', expected 'approved'"
+        )
+
+    if cr.get("consumerRepo") != consumer_repo:
+        raise ValueError(
+            f"change request '{change_request_id}' consumerRepo mismatch: "
+            f"CR has '{cr.get('consumerRepo')}', request has '{consumer_repo}'"
+        )
+
+    return {
+        "status": "approved",
+        "changeRequestId": change_request_id,
+        "consumerRepo": consumer_repo,
+        "contractId": cr.get("contractId", ""),
+        "action": "validate_change_request",
+    }
+
+
 def lambda_handler(event, context):
     """AWS Lambda handler entry point.
 
@@ -270,6 +317,8 @@ def lambda_handler(event, context):
             result = _submit_contract(payload)
         elif action == "report_error":
             result = _report_error(payload)
+        elif action == "validate_change_request":
+            result = _validate_change_request(payload)
         else:
             return {
                 "statusCode": 400,