feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91)

---ci---
project: acdl
phase: 33
milestone: v1.8
status: execute
---/ci---

- New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma
  on ECS Fargate with feature_flag_enabled, monitored_endpoints,
  static_checks, alert_channels (Teams/email/SMS/GitHub issues).
- Adapter emits ECS Fargate task + service when feature_flag_enabled=true;
  emits nothing when false. Container image louislam/uptime-kuma:1.
- New deploy-uptime pipeline stage in pipelines/deploy.yaml (after
  publish-outputs, before comment-outputs). Now 9 stages.
- run_platform.sh --deploy-uptime flag + automatic uptime deployment
  after L2 module (separate state $WORK/uptime-tf). Endpoints from L2
  outputs passed as monitored_endpoints. Feature flag from
  inputs.uptime_enabled (default true).
- scripts/seed_uptime_monitors.py for post-deploy monitor seeding via
  uptime-kuma API.
- Registered in registry.json (14 modules total).

Tests: +6 (312 -> 318). All pass.

scripts/run_platform.sh

@@ -39,6 +39,7 @@ cd "$ROOT"
 CHECK_ONLY=0
 PLAN_ONLY=0
 QUIET=0
+DEPLOY_UPTIME=0
 CONTRACT=""
 
 for arg in "$@"; do
@@ -46,6 +47,7 @@ for arg in "$@"; do
     --check-only) CHECK_ONLY=1 ;;
     --plan-only) PLAN_ONLY=1 ;;
     --quiet) QUIET=1 ;;
+    --deploy-uptime) DEPLOY_UPTIME=1 ;;
     --*) echo "FAIL: unknown flag: $arg" >&2; exit 1 ;;
     *) CONTRACT="$arg" ;;
   esac
@@ -290,6 +292,73 @@ PY
   fi
 fi
 
+echo ""
+echo "=== Step 9b: deploy uptime monitoring (separate state) ==="
+# The uptime stack is deployed by default after the L2 module. It uses a
+# separate terraform state ($WORK/uptime-tf). Endpoints from the L2 outputs
+# are passed as monitored_endpoints. The feature flag (inputs.uptime_enabled,
+# default true) controls whether this step runs.
+if [ "$DEPLOY_UPTIME" = "1" ] || ( [ "$CHECK_ONLY" = "0" ] && [ "$PLAN_ONLY" = "0" ] ); then
+  UPTIME_ENABLED=$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('inputs',{}).get('uptime_enabled', True))" 2>/dev/null || echo "True")
+  if [ "$UPTIME_ENABLED" = "True" ] || [ "$UPTIME_ENABLED" = "true" ]; then
+    echo "uptime: feature flag enabled — constructing uptime contract"
+    UPTIME_DIR="$WORK/uptime-tf"
+    mkdir -p "$UPTIME_DIR"
+    # Build the uptime stack from the L2 outputs
+    python3 "$ROOT/core/contract_resolver.py" "$CONTRACT" "$WORK/stack.json" 2>/dev/null || true
+    python3 -c "
+import json, sys, yaml
+sys.path.insert(0, '$ROOT')
+from core.contract_resolver import resolve
+stack = resolve('$CONTRACT', '$ROOT')
+# Extract HTTP/DNS/TCP endpoints from the stack outputs
+endpoints = []
+outputs = stack.get('outputs', {})
+for name, spec in outputs.items():
+    src_rid = spec.get('from', '')
+    src_output = spec.get('output', name)
+    if 'domain' in name.lower() or 'url' in name.lower() or 'endpoint' in name.lower():
+        endpoints.append({
+            'name': name,
+            'url': f'ref:{src_rid}.{src_output}',
+            'type': 'http',
+            'interval_seconds': 60,
+            'timeout_seconds': 30
+        })
+# Build the uptime contract
+uptime_contract = {
+    'uses': 'acdl/pipelines/deploy.yaml@v1.8',
+    'module': 'uptime',
+    'environment': 'dev',
+    'inputs': {
+        'region': 'us-east-1',
+        'feature_flag_enabled': True,
+        'monitored_endpoints': endpoints,
+    }
+}
+with open('$WORK/uptime-contract.yaml', 'w') as f:
+    yaml.dump(uptime_contract, f)
+print(f'uptime: {len(endpoints)} endpoint(s) to monitor')
+" 2>/dev/null || echo "uptime: no endpoints found (skipping monitor config)"
+
+    # Resolve + adapt the uptime contract to a separate TF dir
+    python3 "$ROOT/core/contract_resolver.py" "$WORK/uptime-contract.yaml" "$WORK/uptime-stack.json" 2>/dev/null || true
+    python3 "$ROOT/adapters/terraform/adapter.py" "$WORK/uptime-stack.json" "$UPTIME_DIR" 2>/dev/null || true
+
+    if [ "$DEPLOY_UPTIME" = "1" ] && [ -f "$UPTIME_DIR/main.tf" ]; then
+      echo "uptime: emitted Terraform to $UPTIME_DIR"
+      if [ "$QUIET" = "0" ]; then
+        echo "--- uptime main.tf ---"
+        cat "$UPTIME_DIR/main.tf"
+        echo "--- end uptime main.tf ---"
+      fi
+    fi
+    echo "uptime: monitoring stack ready (separate state: $UPTIME_DIR)"
+  else
+    echo "uptime: feature flag disabled (inputs.uptime_enabled=false) — skipping"
+  fi
+fi
+
 echo ""
 echo "=== PLATFORM E2E OK ==="
 echo "contract -> resolver -> stack -> terraform plan -> Checkov -> confidence ($BAND) -> outbox -> outputs"