feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)

SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---

docs/NOVA_MIGRATION.md

@@ -63,15 +63,18 @@ scheduled into a phase, ships with a grace period, and has a cutoff.
   dual-read, you can do this incrementally across P2–P4 — but it must be
   complete before P5.
 
-### 3. SSM parameter path — Phase P3
+### 3. SSM parameter path — Phase P3 (DONE)
 
 - **Old:** `/acdl/{env}/{contractId}/{output}`
 - **New:** `/nova/{env}/{contractId}/{output}`
-- **Phase:** P3 (SSM paths + tag keys)
+- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
 - **Grace period — parallel-write:** during P3–P4 the platform **writes
   every output to both** the `/acdl/…` and `/nova/…` SSM paths, and reads
   from `/nova/…` first (falling back to `/acdl/…`). Any hardcoded SSM path
-  reads in your application code keep resolving through P4.
+  reads in your application code keep resolving through P4. The P3
+  migration script (`scripts/migrate_ssm_paths.py`) copies existing
+  `/acdl/…` parameters to `/nova/…`, verifies the copy, and deletes the
+  old ones.
 - **Cutoff:** P5 stops writing to `/acdl/…` and removes the read fallback.
   After P5 only `/nova/…` exists.
 - **What you must do:** if your application code or runbooks read deploy
@@ -80,19 +83,22 @@ scheduled into a phase, ships with a grace period, and has a cutoff.
   issue surface, you do nothing — the platform republishes under the new
   path automatically.
 
-### 4. AWS tag keys — Phase P3
+### 4. AWS tag keys — Phase P3 (DONE)
 
 - **Old:** `acdl:owner`, `acdl:environment`, `acdl:contract`,
   `acdl:cost-center`, `acdl:ref`
 - **New:** `nova:owner`, `nova:environment`, `nova:contract`,
   `nova:cost-center`, `nova:ref`
-- **Phase:** P3 (SSM paths + tag keys)
+- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
 - **Grace period — parallel-tag period:** during P3–P4 the platform
   **tags every resource with both** the `acdl:*` and `nova:*` keys (same
   values). The ABAC session policy matches on **either** key set, so your
   existing scoped permissions keep working. The default cost-center value
   moves from `acdl-default` to `nova-default` (both written during the
-  parallel-tag period).
+  parallel-tag period). Terraform now emits `nova:*` keys; old `acdl:*`
+  tags on pre-P3 live resources are removed by the P4 runbook's
+  `scripts/untag_acdl_keys.py` step after the `nova:*` tags are applied
+  live.
 - **Cutoff:** P5 stops writing the `acdl:*` keys and the ABAC policy matches
   only on `nova:*`. After P5, resources created before P5 still carry the
   old `acdl:*` tags (tags are not retroactively rewritten) but **new**