feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134)

---
ci---
project: acdl
phase: 67b
milestone: v1.12
status: execute
---
/ci---

The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS
mutation, no credentials, no cost) so it runs on every PR. A CI variable
ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default
'plan') overrides to 'full' for the real apply->modify->destroy against
live AWS.

Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh /
run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and
dispatch to --plan-only (plan mode) or --apply/--destroy (full mode).
Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output
injection is gated on full mode.

Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode
as a workflow_dispatch input (choice: plan/full), pass it via env:
ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply +
ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle
+ l2-lifecycle jobs with if: always() so they execute (plan-only) even
when ci-vpc-apply is skipped.

Contract + schema: pipelines/modules-lifecycle.yml gains default_mode:
plan; the schema accepts default_mode (enum plan|full) and a richer
workflow_dispatch inputs shape.

Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) +
10 new tests in TestModulesLifecyclePipeline (workflow flag wiring,
byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to
reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on
the s3 module (--plan-only green, no AWS apply).

scripts/run_lifecycle_destroy.sh

@@ -5,6 +5,11 @@
 #
 # For VPC-dependent modules, injects CI VPC outputs into the complex contract
 # before destroy (so terraform can find the resources in the right VPC).
+#
+# Lifecycle mode (REQ-134): ACDL_LIFECYCLE_MODE default "plan" = no-op
+# (plan mode never applies resources, so there is nothing to destroy; the
+# script exits 0 so the pipeline matrix cell stays green). Set to "full"
+# for the real `--destroy` against live AWS.
 set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
@@ -12,6 +17,15 @@ cd "$ROOT"
 MODULE="$1"
 CI_VPC_OUTPUTS="${2:-}"
 
+# Lifecycle mode: "plan" (default) skips destroy (nothing was applied);
+# "full" runs the real terraform destroy.
+LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
+
+if [ "$LIFECYCLE_MODE" != "full" ]; then
+  echo "lifecycle mode=$LIFECYCLE_MODE — nothing to destroy (plan-only run), exiting 0"
+  exit 0
+fi
+
 CONTRACT="modules/l1/${MODULE}/examples/complex.yml"
 
 VPC_DEPENDENT="alb ecs-service rds uptime"