refactor(modules): remove thin-composition layer; rewrite all module READMEs

The L2 thin-composition layer (composition.json + contract_resolver.py +
contract schema + sample contracts) has been removed completely. The
implementation was unsatisfactory and is deferred for a later redesign.

- Delete: composition.json x2, contract_resolver.py, contracts/ x2,
  contract.schema.json
- Patch: run_platform.sh now loads a pre-existing IR instance instead of
  resolving a contract (the downstream adapter/checkov/confidence/outbox
  pipeline is unchanged)
- Prune: L2 entries removed from registry.json (L1 entries unchanged)
- Rewrite: all 7 L1 module READMEs in plain language (no jargon), each
  with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning
  sections derived from interface.json
- Add: 2 L2 placeholder READMEs noting the composition is under redesign
- Add: modules-ir/README.md catalog index + README-TEMPLATE.md

---ci---
project: acdl
phase: 17
milestone: v1.3
status: execute
---/ci---

modules-ir/l2/l2-static-asset/README.md

@@ -1,31 +1,51 @@
-# l2-static-asset — thin-composition (S3 static asset)
+# l2-static-asset — S3 static asset (composition being redesigned)
 
-The v1.1 spike's L2. A thin-composition that references `l1-s3` only
-(depth 1). The contract's inputs (`bucket_name`, `region`) map 1:1
-through the wires to the L1's inputs.
+> **Module kind:** L2 composition  |  **Version:** TBD  |  **Status:** Under redesign
 
-## Composition (the IR-typed thin-composition tree)
+A composition that references the `l1-s3` primitive to deploy a single
+S3 bucket for static asset hosting.
 
-See `composition.json`: `kind=l2`, `depth=1`, one child `l1-s3@1.0.0`,
-wires `{bucket_name → s3.inputs.bucket_name, region → s3.inputs.region}`
-(passthrough).
+**The composition layer is being redesigned.** The previous
+thin-composition implementation (a `composition.json` with children +
+wires) has been removed. A new composition mechanism will be designed
+in a later phase.
 
-## IR → Terraform mapping (D-P10-1)
+## Resources
 
-The Terraform adapter consumes the *resolved IR instance* (which has
-`kind=l2` + the L1 resource `s3` in its `resources` array). For a
-depth-1 thin-composition, the L2 root module **IS** the L1's resource —
-no separate `module "l1_s3" { source = "..." }` block. The existing
-adapter `TYPE_MAP` + resource emission handle both l1 and l2 instances
-(the resources array is the same shape). The `relationships` array is
-ignored at the Terraform level for the spike (composition ordering is
-implicit in the single resource).
+TBD — the composition will reference this L1 primitive:
 
-v1.2 may emit a real `module "l1_s3" { source = "..." }` block when L1s
-become published Terraform modules rather than inline resources.
+| L1 module | Purpose | README |
+|-----------|---------|--------|
+| `l1-s3` | S3 bucket | [README](../l1/l1-s3/README.md) |
 
-## Versioning (W3.D)
+## Inputs
 
-`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
-require a new registry entry (immutable publication); old entries enter
-a 12-month deprecation window.
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Outputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Usage
+
+TBD — the composition mechanism is being redesigned. Until then, use
+`l1-s3` directly. See the [l1-s3 README](../l1/l1-s3/README.md) for a
+usage example.
+
+## Compliance extension points
+
+The composition will need to wire compliance resources when the
+compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
+
+- **KMS key** — shared encryption key for S3 SSE.
+- **S3 access logs** — access logging to a separate audit bucket.
+- **Object Lock** — 7-year immutable retention for evidence.
+- **Public access block** — prevent data exfiltration.
+
+See the [l1-s3 README](../l1/l1-s3/README.md) for per-module compliance
+extension points.
+
+## Versioning
+
+Versioning will be defined when the composition mechanism is
+redesigned.

modules-ir/l2/l2-static-asset/composition.json

@@ -1,17 +0,0 @@
-{
-  "name": "l2-static-asset",
-  "version": "1.0.0",
-  "kind": "l2",
-  "depth": 1,
-  "description": "Thin-composition: a single S3 bucket for static asset hosting. References l1-s3 only (depth 1).",
-  "children": [
-    {
-      "id": "s3",
-      "module": "l1-s3@1.0.0"
-    }
-  ],
-  "wires": {
-    "bucket_name": {"target": "s3", "input": "bucket_name"},
-    "region": {"target": "s3", "input": "region"}
-  }
-}