feat(P57): shell orchestrator lifecycle modes --apply/--destroy

EXECUTE stage. Adds --apply and --destroy modes to run_platform.sh.
The shell owns all terraform lifecycle; Python never runs terraform.

Changes to scripts/run_platform.sh:
- Added APPLY_ONLY and DESTROY_ONLY flags to arg parsing.
- --apply <contract>: resolve -> adapter -> terraform init/validate/plan/
  apply -auto-approve. HITL attestation gate runs before apply for
  qa/prod/dr (REQ-108). Prints terraform outputs after apply. Exits
  with PLATFORM APPLY OK.
- --destroy <contract>: resolve -> adapter -> terraform init/validate/
  destroy -auto-approve. Use --decommission <CR> for gated production
  teardown (D-070 two-step CR validation). Exits with PLATFORM DESTROY OK.
- Updated usage header to document all 5 modes (check-only, plan-only,
  apply, destroy, default full e2e).
- Existing --check-only and --plan-only modes preserved unchanged.

Tests (tests/test_pipeline.py):
- test_run_platform_apply_mode_parses: --apply parses without unknown flag.
- test_run_platform_destroy_mode_parses: --destroy parses without unknown flag.
- test_no_python_runs_terraform_apply_or_destroy: D-101 grep assertion —
  no .py file in scripts/ contains 'terraform apply' or 'terraform destroy'.

Regression: 464 passed, 0 skipped, 5 deselected (slow). --check-only
still works (no regression in existing modes).

---ci---
project: acdl
phase: P57
milestone: v1.11
status: execute
---/ci---

tests/test_pipeline.py

@@ -64,4 +64,32 @@ class TestPipelineIntegration:
             timeout=30,
         )
         assert result.returncode == 0
-        assert "PLATFORM CHECK OK" in result.stdout
+        assert "PLATFORM CHECK OK" in result.stdout
+
+    def test_run_platform_apply_mode_parses(self):
+        """--apply mode parses without 'unknown flag' error (requires a contract)."""
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--apply"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=10,
+        )
+        assert "unknown flag" not in result.stderr
+        assert "contract file required" in result.stderr or result.returncode != 0
+
+    def test_run_platform_destroy_mode_parses(self):
+        """--destroy mode parses without 'unknown flag' error (requires a contract)."""
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--destroy"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=10,
+        )
+        assert "unknown flag" not in result.stderr
+        assert "contract file required" in result.stderr or result.returncode != 0
+
+    def test_no_python_runs_terraform_apply_or_destroy(self):
+        """D-101: Python scripts never run terraform apply or terraform destroy."""
+        scripts_dir = ROOT / "scripts"
+        for py_file in scripts_dir.glob("*.py"):
+            content = py_file.read_text()
+            assert "terraform apply" not in content, f"{py_file.name} contains 'terraform apply'"
+            assert "terraform destroy" not in content, f"{py_file.name} contains 'terraform destroy'"