fix(P30): temp dir isolation + forge-agnostic APIs + static-key override (P1-8, P1-9, S1)

---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---

P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.

Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.

tests/test_contract_ingestor.py

@@ -381,4 +381,40 @@ class TestCallerIdentityValidation:
             "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/acdl-deploy/acdl-consumer-a"}},
         }
         resp = ingestor.lambda_handler(event, None)
-        assert resp["statusCode"] == 200
+        assert resp["statusCode"] == 200
+
+
+class TestForgeAgnosticApiUrls:
+    """P1-9: contract_ingestor uses GITHUB_API_BASE for forge-agnostic URLs."""
+
+    def test_default_api_base_is_github(self):
+        assert ingestor.GITHUB_API_BASE == "https://api.github.com"
+
+    def test_forge_type_detects_gitea(self, monkeypatch):
+        monkeypatch.setattr(ingestor, "GITHUB_API_BASE", "https://git.cloudinit.dev/api/v1")
+        assert ingestor._forge_type() == "gitea"
+
+    def test_forge_type_detects_github(self):
+        assert ingestor._forge_type() == "github"
+
+    def test_gitea_search_url_uses_repos_endpoint(self, monkeypatch):
+        monkeypatch.setattr(ingestor, "GITHUB_API_BASE", "https://git.cloudinit.dev/api/v1")
+        url = ingestor._issues_search_url("acdl", "acdl", "contract-123")
+        assert "git.cloudinit.dev/api/v1" in url
+        assert "/repos/acdl/acdl/issues" in url
+        assert "/search/issues" not in url
+
+    def test_github_search_url_uses_search_endpoint(self):
+        url = ingestor._issues_search_url("acdl", "acdl", "contract-123")
+        assert "api.github.com/search/issues" in url
+        assert "repo:acdl/acdl" in url
+
+    def test_create_url_uses_api_base(self, monkeypatch):
+        monkeypatch.setattr(ingestor, "GITHUB_API_BASE", "https://git.cloudinit.dev/api/v1")
+        url = ingestor._issues_create_url("acdl", "acdl")
+        assert url == "https://git.cloudinit.dev/api/v1/repos/acdl/acdl/issues"
+
+    def test_comments_url_uses_api_base(self, monkeypatch):
+        monkeypatch.setattr(ingestor, "GITHUB_API_BASE", "https://git.cloudinit.dev/api/v1")
+        url = ingestor._issue_comments_url("acdl", "acdl", 42)
+        assert url == "https://git.cloudinit.dev/api/v1/repos/acdl/acdl/issues/42/comments"

tests/test_pipeline_contract.py

@@ -225,7 +225,8 @@ class TestRunPlatformStreaming:
         )
         assert result.returncode == 0
         assert "PLATFORM CHECK OK" in result.stdout
-        assert "--- emitted terraform/spike/main.tf ---" in result.stdout
+        assert "--- emitted" in result.stdout
+        assert "main.tf" in result.stdout
         assert "aws_s3_bucket" in result.stdout
 
     def test_check_only_quiet_suppresses_terraform(self):
@@ -236,7 +237,7 @@ class TestRunPlatformStreaming:
         )
         assert result.returncode == 0
         assert "PLATFORM CHECK OK" in result.stdout
-        assert "--- emitted terraform/spike/main.tf ---" not in result.stdout
+        assert "--- emitted" not in result.stdout
 
 
 class TestDeployPipelineSchema:
@@ -353,6 +354,20 @@ class TestDeployWorkflowConformance:
         assert wf["permissions"]["id-token"] == "write"
         assert wf["permissions"]["contents"] == "read"
 
+    def test_deploy_workflow_static_key_override_wired(self):
+        """S1: the static-key override must be wired to configure-aws-credentials
+        inputs (access-key-id/secret-access-key), not inert env vars."""
+        wf = _load_workflow(".gitea/workflows/deploy.yml")
+        deploy_job = wf["jobs"]["deploy"]
+        creds_step = next(
+            s for s in deploy_job["steps"]
+            if "configure-aws-credentials" in s.get("uses", "")
+        )
+        with_block = creds_step.get("with", {})
+        assert "access-key-id" in with_block, "S1: access-key-id input must be wired"
+        assert "secret-access-key" in with_block, "S1: secret-access-key input must be wired"
+        assert "role-to-assume" in with_block, "S1: role-to-assume must still be present (conditional)"
+
 
 class TestSampleContractVersioning:
     def test_sample_contract_uses_versioned_tag(self):