feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests

Extend the modules-lifecycle pipeline with L2 composition modules
(static-assets, microservice) per REQ-128:

- pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy
  stages + l2_modules matrix entry
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
  added l2-lifecycle job (byte-identical), matrix over [static-assets,
  microservice], needs ci-vpc-apply, has apply/modify/destroy steps.
  ci-vpc-destroy now needs both [lifecycle, l2-lifecycle].
- schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix
- scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers
  that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the
  microservice composition's terraform_remote_state reads from the CI VPC
- adapters/terraform/adapter.py: parameterized remote_state key via
  ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate)
- modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match
  simple (my-static-site) so terraform modifies in-place (adds CDN + WAF)
- modules/l2/microservice/examples/complex.yml: fixed bucket_name to match
  simple (my-microservice-demo), added desired_count:2 (modify variant)
- tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix
  lists both modules, apply/modify/destroy steps, needs ci-vpc-apply,
  ci-vpc-destroy needs both, contract matrix lists l2_modules)
- pipelines/README.md: updated stages for L2

Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical.

---ci---
project: acdl
phase: P61
milestone: v1.11
status: execute
---/ci---

pipelines/README.md

@@ -10,7 +10,7 @@ ACDL uses declarative pipeline contracts (YAML) as the single source of truth. B
 | --- | --- | --- | --- |
 | ACDL CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` |
 | ACDL Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
-| ACDL Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` |
+| ACDL Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `l2-lifecycle-apply`, `l2-lifecycle-modify`, `l2-lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` |
 
 ## How to Write a Pipeline
 

pipelines/modules-lifecycle.yml

@@ -49,7 +49,24 @@ stages:
     required: false
     description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"
 
+  # L2 lifecycle stages (composition modules)
+  - name: l2-lifecycle-apply
+    command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/simple.yml"
+    required: true
+    description: "Apply the L2 module's simple example contract (terraform apply)"
+
+  - name: l2-lifecycle-modify
+    command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/complex.yml"
+    required: true
+    description: "Apply the L2 module's complex example (same state key — terraform modifies)"
+
+  - name: l2-lifecycle-destroy
+    command: bash scripts/run_platform.sh --destroy "modules/l2/${L2_MODULE}/examples/complex.yml"
+    required: true
+    description: "Destroy the L2 module's resources (terraform destroy)"
+
 matrix:
   modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
   vpc_dependent: [alb, ecs-service, rds, uptime]
-  independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]
+  independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]
+  l2_modules: [static-assets, microservice]