feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)

---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---

- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
  (PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
  queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
  counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
  (mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
  deletion_protection=false (step 1), then decommission_transform
  (step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
  CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.

Tests: +14 (318 -> 332). All pass.

terraform/platform/main.tf

@@ -113,6 +113,11 @@ resource "aws_iam_role_policy" "lambda_permissions" {
         Action   = ["dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:UpdateItem"]
         Resource = aws_dynamodb_table.acdl_contracts.arn
       },
+      {
+        Effect   = "Allow"
+        Action   = ["dynamodb:GetItem", "dynamodb:Query"]
+        Resource = aws_dynamodb_table.acdl_change_requests.arn
+      },
       {
         Effect   = "Allow"
         Action   = ["secretsmanager:GetSecretValue"]
@@ -182,4 +187,38 @@ locals {
 output "consumer_invoke_policy_rendered" {
   value       = local.rendered_invoke_policy
   description = "The consumer invoke policy JSON with the live account ID rendered. Distribute this to consumer accounts during onboarding."
+}
+
+# REQ-93: DynamoDB table for change requests (CMDB for decommission validation)
+resource "aws_dynamodb_table" "acdl_change_requests" {
+  name         = "acdl-change-requests"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "changeRequestId"
+  range_key    = "submittedAt"
+
+  attribute {
+    name = "changeRequestId"
+    type = "S"
+  }
+
+  attribute {
+    name = "submittedAt"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  server_side_encryption {
+    enabled     = true
+    kms_key_arn = aws_kms_key.acdl_platform.arn
+  }
+
+  tags = {
+    acdl:owner       = "acdl"
+    acdl:contract    = "platform"
+    acdl:environment = "prod"
+    acdl:cost-center = "acdl-default"
+  }
 }