feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests

EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests
every L1 module's examples/{simple,complex}.yml contracts through
apply→modify→destroy against live AWS. No per-module Python.

New files:
- pipelines/modules-lifecycle.yml: declarative contract (5 stages:
  platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy,
  platform-vpc-destroy). Matrix over 12 L1 modules.
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
  byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite),
  lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy
  (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch.
- schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline
  shape (extends pipeline.schema.json with workflow_dispatch + matrix).

Tests (tests/test_pipeline_contract.py):
- TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates,
  byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1
  modules, apply/modify/destroy steps present, platform-vpc-destroy always runs).

pipelines/README.md: added modules-lifecycle to the pipeline table.

Regression: 479 passed, 0 skipped, 5 deselected (slow).

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

.gitea/workflows/modules-lifecycle.yml

@@ -0,0 +1,110 @@
+# ACDL Modules Lifecycle Pipeline — Gitea Actions (dev environment)
+#
+# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts through
+# apply→modify→destroy against live AWS. No per-module Python. The "test" =
+# the pipeline cell going green.
+#
+# This workflow implements pipelines/modules-lifecycle.yml (byte-identical
+# in .gitea/workflows/ and .github/workflows/).
+#
+# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
+# applied by a prerequisite job. Non-VPC L1s run independent.
+name: acdl-modules-lifecycle
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  # Prerequisite: apply the shared platform VPC (needed by VPC-dependent L1s)
+  platform-vpc-apply:
+    name: Platform VPC apply
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install Terraform 1.9.*
+        run: |
+          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: us-east-1
+          access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+      - name: Apply platform VPC
+        working-directory: terraform/platform
+        run: |
+          terraform init -input=false -lock=false
+          terraform apply -auto-approve -lock=false
+
+  # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
+  lifecycle:
+    name: L1 lifecycle (${{ matrix.module }})
+    needs: platform-vpc-apply
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: pip install jsonschema pyyaml boto3
+      - name: Install Terraform 1.9.*
+        run: |
+          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: us-east-1
+          access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+      - name: Apply (simple)
+        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
+      - name: Modify (complex)
+        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
+      - name: Destroy
+        run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
+
+  # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
+  platform-vpc-destroy:
+    name: Platform VPC destroy
+    needs: lifecycle
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install Terraform 1.9.*
+        run: |
+          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: us-east-1
+          access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+      - name: Destroy platform VPC
+        working-directory: terraform/platform
+        run: |
+          terraform init -input=false -lock=false
+          terraform destroy -auto-approve -lock=false