fix(P59): 3 pipeline-readiness fixes — resolver id, schema inputs, CI creds

3 fixes found during the pipeline-readiness audit (all 24 example contracts
now resolve + adapt + pass --check-only):

1. core/contract_resolver.py: L1 resolver resource id now replaces underscores
   with hyphens (task_definition → task-definition), matching the L2 resolver
   pattern. The stack schema requires ^[a-z][a-z0-9-]*$ (no underscores).

2. schemas/stack.schema.json: relaxed input type constraint to allow array +
   object (was string/number/boolean only). Real-world inputs include lists
   (monitored_endpoints, static_checks, rules) and dicts (alert_channels).

3. scripts/run_platform.sh: AWS creds loading is now conditional — if
   AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are already set (by the CI
   configure-aws-credentials action), skip loading .env.secrets. This makes
   the --apply/--destroy modes work in CI without the gitignored secrets file.

Regression: 479 passed, 0 skipped, 5 deselected.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

scripts/run_platform.sh

@@ -277,14 +277,18 @@ print(f\"adapter output: OK ({d['stack']['name']}, {len(d['resources'])} resourc
 fi
 
 echo "=== Loading AWS credentials (not needed for --check-only) ==="
-ENV_FILE="$ROOT/.env.secrets"
-[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh)"
-set -a
-. "$ENV_FILE"
-set +a
-export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
-export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
-export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+# In CI, the configure-aws-credentials action sets AWS_ACCESS_KEY_ID and
+# AWS_SECRET_ACCESS_KEY as env vars directly. Locally, we load from .env.secrets.
+if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
+  ENV_FILE="$ROOT/.env.secrets"
+  [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
+  set -a
+  . "$ENV_FILE"
+  set +a
+  export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+  export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+  export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+fi
 
 echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
 cd "$TF_DIR"