verify(P0): code review — security+correctness — fix Step 5b heredoc shell-var injection

The Step 5b kyverno-json block used a single-quoted heredoc (<<'PY') but
referenced $WORK and $CONTRACT_ID inside the Python body as literal
strings — neither variable expanded, so kj scan ran against the literal
filename "$WORK/tfshow.json" (FileNotFoundError) and recorded contractId
"$CONTRACT_ID" verbatim. The entire Step 5b plan-JSON policy pass was
silently broken whenever kj was installed (it only "worked" in the
kj-absent skip path, which the tests exercise).

Fix: pass the two values as argv (python3 - "$WORK/tfshow.json"
"$CONTRACT_ID" <<'PY') and read them via sys.argv. This preserves the
single-quoted heredoc (no shell expansion into Python source — avoids a
payload-injection vector if $CONTRACT_ID ever contained a quote) while
correctly threading the values into the engine.

---ci---
project: acdl
phase: 5
milestone: v1.25-kyverno-json
status: verify
lessons:
  - P0 fix applied: Step 5b heredoc <<'PY' prevented $WORK/$CONTRACT_ID
    expansion → kj scan read literal filename, Step 5b silently broken
    whenever kj installed. Re-threaded via sys.argv (also closes a
    payload-injection vector vs naively unquoting the heredoc).
---/ci---

scripts/run_platform.sh

@@ -533,7 +533,7 @@ if command -v kj >/dev/null 2>&1; then
   if [ -f "$TF_DIR/tfplan" ]; then
     terraform -chdir="$TF_DIR" show -json tfplan > "$WORK/tfshow.json" 2>/dev/null || true
     if [ -s "$WORK/tfshow.json" ]; then
-      python3 - <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
+      python3 - "$WORK/tfshow.json" "$CONTRACT_ID" <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
 import json, sys
 from pathlib import Path
 sys.path.insert(0, ".")
@@ -541,10 +541,11 @@ import importlib.util
 _spec = importlib.util.spec_from_file_location("kj_engine", "adapters/kyverno-json/kyverno_json_engine.py")
 _mod = importlib.util.module_from_spec(_spec)
 _spec.loader.exec_module(_mod)
+_payload_path, _contract_id = sys.argv[1], sys.argv[2]
 eng = _mod.KyvernoJsonEngine()
 if not eng.is_configured():
     print("[]"); sys.exit(0)
-out = eng.evaluate(json.load(open("$WORK/tfshow.json")), Path("adapters/kyverno-json/policies/plan-json"), "$CONTRACT_ID")
+out = eng.evaluate(json.load(open(_payload_path)), Path("adapters/kyverno-json/policies/plan-json"), _contract_id)
 print(json.dumps(out))
 PY
       if [ -s "$WORK/kj-pcr.json" ]; then