feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests

EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests
every L1 module's examples/{simple,complex}.yml contracts through
apply→modify→destroy against live AWS. No per-module Python.

New files:
- pipelines/modules-lifecycle.yml: declarative contract (5 stages:
  platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy,
  platform-vpc-destroy). Matrix over 12 L1 modules.
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
  byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite),
  lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy
  (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch.
- schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline
  shape (extends pipeline.schema.json with workflow_dispatch + matrix).

Tests (tests/test_pipeline_contract.py):
- TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates,
  byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1
  modules, apply/modify/destroy steps present, platform-vpc-destroy always runs).

pipelines/README.md: added modules-lifecycle to the pipeline table.

Regression: 479 passed, 0 skipped, 5 deselected (slow).

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

pipelines/README.md

@@ -10,6 +10,7 @@ ACDL uses declarative pipeline contracts (YAML) as the single source of truth. B
 | --- | --- | --- | --- |
 | ACDL CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` |
 | ACDL Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
+| ACDL Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` |
 
 ## How to Write a Pipeline
 

pipelines/modules-lifecycle.yml

@@ -0,0 +1,55 @@
+name: acdl-modules-lifecycle
+
+# ACDL Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
+#
+# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
+#   1. --apply simple.yml (terraform apply — creates resources)
+#   2. --apply complex.yml (same state key — terraform modifies)
+#   3. --destroy complex.yml (terraform destroy — cleans up)
+#
+# No per-module Python. The "test" = the pipeline cell going green.
+# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform
+# VPC applied by a prerequisite job. Non-VPC L1s run independent.
+#
+# Both Gitea (.gitea/workflows/modules-lifecycle.yml) and GitHub
+# (.github/workflows/modules-lifecycle.yml) implement this contract
+# byte-identically.
+
+triggers:
+  pull_request: [main]
+  workflow_dispatch: []
+
+runner: ubuntu-latest
+python_version: "3.12"
+terraform_version: "1.9.*"
+
+stages:
+  - name: platform-vpc-apply
+    command: cd terraform/platform && terraform init -input=false && terraform apply -auto-approve -lock=false
+    required: true
+    description: "Apply the shared platform VPC (prerequisite for VPC-dependent L1s)"
+
+  - name: lifecycle-apply
+    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/simple.yml"
+    required: true
+    description: "Apply the module's simple example contract (terraform apply)"
+
+  - name: lifecycle-modify
+    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/complex.yml"
+    required: true
+    description: "Apply the module's complex example (same state key — terraform modifies)"
+
+  - name: lifecycle-destroy
+    command: bash scripts/run_platform.sh --destroy "modules/l1/${MODULE}/examples/complex.yml"
+    required: true
+    description: "Destroy the module's resources (terraform destroy)"
+
+  - name: platform-vpc-destroy
+    command: cd terraform/platform && terraform destroy -auto-approve -lock=false
+    required: false
+    description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"
+
+matrix:
+  modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
+  vpc_dependent: [alb, ecs-service, rds, uptime]
+  independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]