feat(P21): environments concept + onboarding scaffold (REQ-61)

---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---

Introduce platform-managed environments: a consumer does not provide an
AWS account, VPC, subnet, S3 state bucket, or runner key. A named
environment is a platform-owned bundle of account + network + state
backend + IAM role (surfaced via ABAC), selected by name in the contract.

Scaffold:
- core/environments/dev.json (sample dev env definition)
- core/environments/README.md (how envs are used + how to add one)
- core/environment_check.py (reads a contract's environment field,
  looks up core/environments/<name>.json, prints a friendly onboarding
  prompt when none exists, exits non-zero)
- scripts/run_platform.sh: Step 0 calls environment_check.py before
  contract validation; a missing env halts the pipeline with the
  onboarding prompt
- tests/test_environment_check.py: 12 tests (dev bound, missing env ->
  onboarding prompt, onboarding message lists provisions, contract
  paths, wire-in, check-only still passes)

Tests: 166 pass (154 + 12 new).

core/environments/README.md

@@ -0,0 +1,27 @@
+# Platform-managed environments
+
+This directory holds environment definitions used by the onboarding scaffold.
+Each file is a named environment the platform owns (an AWS account or
+scoped partition, a network, a state backend, and an IAM role surfaced to
+the consumer via ABAC).
+
+A consumer never provides an AWS account, VPC, subnet, S3 state bucket, or
+runner key — the platform manages all of that here.
+
+## Files
+
+- `dev.json` — the default dev environment (autonomous, confidence ≥ 0.50).
+
+## How it is used
+
+`core/environment_check.py` reads a contract's `environment` field and
+looks up the matching `<name>.json` in this directory. If no matching file
+exists, the check prints a friendly onboarding prompt and exits non-zero,
+halting the pipeline before any work is done.
+
+## Adding an environment
+
+A new environment is a platform-team action: provision the AWS account /
+network / state backend / IAM role, then add a `<name>.json` here and bind
+it to the consumer repo. Self-service environment provisioning is on the
+roadmap; today it is a platform-team action.