feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests

Extend the modules-lifecycle pipeline with L2 composition modules
(static-assets, microservice) per REQ-128:

- pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy
  stages + l2_modules matrix entry
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
  added l2-lifecycle job (byte-identical), matrix over [static-assets,
  microservice], needs ci-vpc-apply, has apply/modify/destroy steps.
  ci-vpc-destroy now needs both [lifecycle, l2-lifecycle].
- schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix
- scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers
  that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the
  microservice composition's terraform_remote_state reads from the CI VPC
- adapters/terraform/adapter.py: parameterized remote_state key via
  ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate)
- modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match
  simple (my-static-site) so terraform modifies in-place (adds CDN + WAF)
- modules/l2/microservice/examples/complex.yml: fixed bucket_name to match
  simple (my-microservice-demo), added desired_count:2 (modify variant)
- tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix
  lists both modules, apply/modify/destroy steps, needs ci-vpc-apply,
  ci-vpc-destroy needs both, contract matrix lists l2_modules)
- pipelines/README.md: updated stages for L2

Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical.

---ci---
project: acdl
phase: P61
milestone: v1.11
status: execute
---/ci---

.github/workflows/modules-lifecycle.yml

@@ -4,13 +4,18 @@
 # apply→modify→destroy against live AWS. No per-module Python. The "test" =
 # the pipeline cell going green.
 #
+# Also matrix-runs L2 composition modules (static-assets, microservice) through
+# the same apply→modify→destroy lifecycle. L2 = composition only (no L2
+# terraform files); the composition must be deterministic.
+#
 # This workflow implements pipelines/modules-lifecycle.yml (byte-identical
 # in .gitea/workflows/ and .github/workflows/).
 #
 # A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
-# modules (alb, ecs-service, rds, uptime) and destroyed after all tests complete.
-# The CI VPC is separate from the long-lived platform VPC. Outputs are read
-# from the S3 state by each lifecycle job (no artifact passing needed).
+# modules (alb, ecs-service, rds, uptime, and L2 microservice) and destroyed
+# after all tests complete. The CI VPC is separate from the long-lived platform
+# VPC. Outputs are read from the S3 state by each lifecycle job (no artifact
+# passing needed).
 name: acdl-modules-lifecycle
 
 on:
@@ -22,7 +27,7 @@ permissions:
   contents: read
 
 jobs:
-  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s)
+  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s + L2 microservice)
   ci-vpc-apply:
     name: CI VPC apply
     runs-on: ubuntu-latest
@@ -92,10 +97,59 @@ jobs:
           AWS_DEFAULT_REGION: us-east-1
         run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
 
+  # L2 lifecycle matrix: apply simple → apply complex (modify) → destroy
+  l2-lifecycle:
+    name: L2 lifecycle (${{ matrix.module }})
+    needs: ci-vpc-apply
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [static-assets, microservice]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: pip install jsonschema pyyaml boto3
+      - name: Install Terraform 1.9.*
+        run: |
+          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Read CI VPC outputs
+        working-directory: terraform/ci-vpc
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: |
+          terraform init -input=false -lock=false
+          terraform output -json > /tmp/ci-vpc-outputs.json
+      - name: Apply (simple)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
+      - name: Modify (complex)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
+      - name: Destroy
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
+
   # Cleanup: destroy the CI VPC (always runs, even if lifecycle fails)
   ci-vpc-destroy:
     name: CI VPC destroy
-    needs: lifecycle
+    needs: [lifecycle, l2-lifecycle]
     runs-on: ubuntu-latest
     if: always()
     steps: