feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)

---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---

- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
  (PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
  queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
  counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
  (mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
  deletion_protection=false (step 1), then decommission_transform
  (step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
  CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.

Tests: +14 (318 -> 332). All pass.

pipelines/deploy.yaml

@@ -1,9 +1,14 @@
-# ACDL Central Deployment Pipeline Contract (v1.5)
+# ACDL Central Deployment Pipeline Contract (v1.8)
 #
 # This is the single source of truth for the deployment pipeline. It
 # declares the stages that run when a consumer submits a contract:
 #   validate-contract -> resolve-stack -> terraform-plan -> checkov ->
-#   confidence -> apply (dev only)
+#   confidence -> apply (dev only) -> publish-outputs -> deploy-uptime ->
+#   comment-outputs
+#
+# Decommission mode (mode: decommission) runs a different set of stages:
+#   validate-change-request -> disable-deletion-protection (HITL SRE) ->
+#   zero-counts (HITL SRE) -> confirm-decommission
 #
 # Consumers reference this pipeline via `uses: acdl/pipelines/deploy.yaml@v1`
 # in their contract YAML. The platform (scripts/run_platform.sh) implements