verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits

---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
  - P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
  - P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
  - P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
  - P2 fix: tagging-standard.json description referenced .yaml instead of .py
  - P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---

Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).

P0 (1, auto-fixed):
  - run_platform.sh --check-only hardcoded static-assets assertions broke
    for other contracts (microservice). Generalized to structural checks.

P1 security fixes applied (2 of 9):
  - P1-1: URL-encode contractId in GitHub search query (injection prevention)
  - P1-2: Validate consumerRepo format (org/repo) when caller identity present

P1 flagged for post-hoc (7):
  - P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
  - P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
  - P1-5: WAF default_action input silently ignored (always emits allow {})
  - P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
  - P1-7: L2 composition outputs section not implemented in resolver
  - P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
  - P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)

P2 nits fixed (2 of 8):
  - P2-2: tagging-standard.json description referenced .yaml instead of .py
  - P2-3: unused graph_resource_name_utils import removed

Tests: 275 passed (was 272; +3 caller identity validation tests).

adapters/terraform/policy/custom_rules/acdl_tagging.py

@@ -12,7 +12,6 @@ from __future__ import annotations
 
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.common.models.consts import graph_resource_name_utils
 
 REQUIRED_TAGS = ("acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center")