feat(P21): environments concept + onboarding scaffold (REQ-61)

---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---

Introduce platform-managed environments: a consumer does not provide an
AWS account, VPC, subnet, S3 state bucket, or runner key. A named
environment is a platform-owned bundle of account + network + state
backend + IAM role (surfaced via ABAC), selected by name in the contract.

Scaffold:
- core/environments/dev.json (sample dev env definition)
- core/environments/README.md (how envs are used + how to add one)
- core/environment_check.py (reads a contract's environment field,
  looks up core/environments/<name>.json, prints a friendly onboarding
  prompt when none exists, exits non-zero)
- scripts/run_platform.sh: Step 0 calls environment_check.py before
  contract validation; a missing env halts the pipeline with the
  onboarding prompt
- tests/test_environment_check.py: 12 tests (dev bound, missing env ->
  onboarding prompt, onboarding message lists provisions, contract
  paths, wire-in, check-only still passes)

Tests: 166 pass (154 + 12 new).

core/environments/dev.json

@@ -0,0 +1,17 @@
+{
+  "name": "dev",
+  "description": "Default platform-managed dev environment for onboarding demos.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-dev-state",
+    "lock_table": "acdl-dev-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.0.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-dev-runner",
+  "autonomy": "full",
+  "confidence_threshold": 0.50
+}