fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed

The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.

Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
   ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
   signing_behavior, signing_protocol, origin_access_control_id,
   s3_origin_config.origin_access_identity, origin_id, rule (singular),
   scope=CLOUDFRONT (uppercase).

New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]

6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.

Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.

---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
  covered: [REQ-114]
  partial: []
decisions: [D-090, D-093]
regression:
  - { capability: CAP-013, status: Verified }
  - { capability: CAP-014, status: Verified }
  - { capability: CAP-015, status: Verified }
  - { capability: CAP-016, status: Verified }
---/ci---

tests/test_adapter.py

@@ -337,11 +337,15 @@ class TestWAFAdapterFixes:
         }
 
     def test_waf_custom_rules_emit_nested_blocks(self, waf_stack_with_custom_rules, tmp_path):
-        """P1-4: rules must be nested blocks, not `rules = [...]`."""
+        """P1-4: rules must be nested blocks, not `rules = [...]`.
+
+        Note: the Terraform aws_wafv2_web_acl resource uses `rule` blocks
+        (singular), not `rules`. The adapter was corrected in Phase 54
+        (D-093 sweep) to emit `rule {` to match the AWS provider v5 schema."""
         out_dir = str(tmp_path / "tf_out")
         adapt(waf_stack_with_custom_rules, out_dir)
         main_tf = open(os.path.join(out_dir, "main.tf")).read()
-        assert "rules {" in main_tf
+        assert "rule {" in main_tf
         assert 'name = "rate-limit"' in main_tf
         assert 'name = "geo-block"' in main_tf
         assert "rules = [" not in main_tf