feat(P21): environments concept + onboarding scaffold (REQ-61)

---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---

Introduce platform-managed environments: a consumer does not provide an
AWS account, VPC, subnet, S3 state bucket, or runner key. A named
environment is a platform-owned bundle of account + network + state
backend + IAM role (surfaced via ABAC), selected by name in the contract.

Scaffold:
- core/environments/dev.json (sample dev env definition)
- core/environments/README.md (how envs are used + how to add one)
- core/environment_check.py (reads a contract's environment field,
  looks up core/environments/<name>.json, prints a friendly onboarding
  prompt when none exists, exits non-zero)
- scripts/run_platform.sh: Step 0 calls environment_check.py before
  contract validation; a missing env halts the pipeline with the
  onboarding prompt
- tests/test_environment_check.py: 12 tests (dev bound, missing env ->
  onboarding prompt, onboarding message lists provisions, contract
  paths, wire-in, check-only still passes)

Tests: 166 pass (154 + 12 new).

scripts/run_platform.sh

@@ -89,6 +89,19 @@ CONTRACT_ID="11111111-1111-1111-1111-111111111111"  # spike fixed UUID
 WORK="/tmp/acdl_platform_run"
 rm -rf "$WORK"; mkdir -p "$WORK"
 
+echo "=== Step 0: environment onboarding check ==="
+if [ -f "$CONTRACT" ]; then
+  python3 core/environment_check.py "$CONTRACT" || {
+    echo "FAIL: environment not bound — see the onboarding prompt above" >&2
+    exit 1
+  }
+else
+  python3 core/environment_check.py --env=dev || {
+    echo "FAIL: environment not bound — see the onboarding prompt above" >&2
+    exit 1
+  }
+fi
+
 echo "=== Step 1: validate contract against contract.schema.json ==="
 [ -f "$CONTRACT" ] || fail "contract file $CONTRACT missing"
 python3 -c "