fix(P59): 3 pipeline-readiness fixes — resolver id, schema inputs, CI creds

3 fixes found during the pipeline-readiness audit (all 24 example contracts
now resolve + adapt + pass --check-only):

1. core/contract_resolver.py: L1 resolver resource id now replaces underscores
   with hyphens (task_definition → task-definition), matching the L2 resolver
   pattern. The stack schema requires ^[a-z][a-z0-9-]*$ (no underscores).

2. schemas/stack.schema.json: relaxed input type constraint to allow array +
   object (was string/number/boolean only). Real-world inputs include lists
   (monitored_endpoints, static_checks, rules) and dicts (alert_channels).

3. scripts/run_platform.sh: AWS creds loading is now conditional — if
   AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are already set (by the CI
   configure-aws-credentials action), skip loading .env.secrets. This makes
   the --apply/--destroy modes work in CI without the gitignored secrets file.

Regression: 479 passed, 0 skipped, 5 deselected.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

core/contract_resolver.py

@@ -186,7 +186,7 @@ def _resolve_l1(module_name, version, inputs, registry, repo_root):
 
     # Build the resource
     resource = {
-        "id": iface.get("type", module_name).split(":")[-1]
+        "id": iface.get("type", module_name).split(":")[-1].replace("_", "-")
         if ":" in iface.get("type", "") else module_name,
         "type": iface["type"],
         "module": module_ref,

schemas/stack.schema.json

@@ -92,7 +92,7 @@
         "inputs": {
           "type": "object",
           "description": "Input values keyed by the module's declared inputs. Free-form in v1 (validated at contract->stack resolution against the module registry); typed per-module in v1.2.",
-          "additionalProperties": {"type": ["string", "number", "boolean"]}
+          "additionalProperties": {"type": ["string", "number", "boolean", "array", "object"]}
         },
         "outputs": {
           "type": "object",

scripts/run_platform.sh

@@ -277,14 +277,18 @@ print(f\"adapter output: OK ({d['stack']['name']}, {len(d['resources'])} resourc
 fi
 
 echo "=== Loading AWS credentials (not needed for --check-only) ==="
-ENV_FILE="$ROOT/.env.secrets"
-[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh)"
-set -a
-. "$ENV_FILE"
-set +a
-export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
-export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
-export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+# In CI, the configure-aws-credentials action sets AWS_ACCESS_KEY_ID and
+# AWS_SECRET_ACCESS_KEY as env vars directly. Locally, we load from .env.secrets.
+if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
+  ENV_FILE="$ROOT/.env.secrets"
+  [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
+  set -a
+  . "$ENV_FILE"
+  set +a
+  export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+  export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+  export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+fi
 
 echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
 cd "$TF_DIR"