feat(P56): IAM re-bootstrap — policy extension + IAM_POLICY.md + baseline test

Vertical slice 1 of Phase 56 (REQ-116). Offline-testable deliverables
landed; the live IAM apply step is escalated (D-095) below.

terraform/bootstrap/spike_runner_policy.json — extended with the minimum
permissions to terraform apply + probe CAP-017..022:
- cloudfront:* (CAP-020 static-assets stack)
- wafv2:* (CAP-020 WAF ACL)
- lambda:* on function:acdl-* (CAP-018 contract-ingestor)
- dynamodb:* on acdl-contracts + acdl-change-requests (CAP-017)
- secretsmanager:GetSecretValue on secret:acdl/* (CAP-018 github-token)
- sns:* on acdl-* (CAP-017 acdl-sod-halt)
- ce:Get* (REQ-119 Cost Explorer read-only)
- kms:* (CAP-017 platform + per-stack CMKs)
- iam:CreateOpenIDConnectProvider + iam:CreateRole (CAP-022 OIDC re-create)

.ciagent/IAM_POLICY.md — new baseline document. Original grants
(v1.1–v1.10) + v1.11 grants table + least-privilege scoping notes +
OIDC act_runner role plan + D-095 escalation note.

tests/test_iam_policy_baseline.py — 15 tests. Asserts the required
actions are present per service group, Lambda scoped to acdl-*, CE
read-only, no iam:PassRole to Resource:*, DynamoDB acdl-contracts in
resource. Regression-testable: any future permission drift surfaces as
a test failure at milestone COMPLETE (D-091 gate).

Test results: 15/15 pass. Full offline suite 509/509 pass (pre-existing
test_seeded_registry_runs_and_reports_honest_status in
test_verify_regression_mode.py hangs without AWS creds — environmental,
not introduced here).

---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
  type: deploy
  id: D-095
  reason: ACDL_BOOTSTRAP_AWS_* not set in the execution environment
  blocking: live IAM policy apply (aws iam put-user-policy) + OIDC role
    re-creation (CAP-022) — requires an admin AWS principal
  action_required: provide fresh ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID +
    ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the run environment, then
    re-invoke ciagent-run to resume Phase 56 live step
  fallback: none (D-095 confirmed: escalate to human, no silent fallback
    to the deck-marking path)
---/ci---

terraform/bootstrap/spike_runner_policy.json

@@ -101,6 +101,139 @@
         "ec2:Authorize*"
       ],
       "Resource": "arn:aws:ec2:us-east-1:581513795199:*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "cloudfront:Create*",
+        "cloudfront:Describe*",
+        "cloudfront:Get*",
+        "cloudfront:List*",
+        "cloudfront:Update*",
+        "cloudfront:Delete*",
+        "cloudfront:TagResource",
+        "cloudfront:UntagResource"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "wafv2:Create*",
+        "wafv2:Describe*",
+        "wafv2:Get*",
+        "wafv2:List*",
+        "wafv2:Update*",
+        "wafv2:Delete*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "lambda:Create*",
+        "lambda:Get*",
+        "lambda:List*",
+        "lambda:Update*",
+        "lambda:Delete*",
+        "lambda:InvokeFunction",
+        "lambda:InvokeFunctionUrl",
+        "lambda:TagResource",
+        "lambda:UntagResource",
+        "lambda:PublishLayerVersion"
+      ],
+      "Resource": "arn:aws:lambda:us-east-1:581513795199:function:acdl-*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:Create*",
+        "dynamodb:Describe*",
+        "dynamodb:Get*",
+        "dynamodb:Put*",
+        "dynamodb:Update*",
+        "dynamodb:Delete*",
+        "dynamodb:Query",
+        "dynamodb:Scan",
+        "dynamodb:Batch*"
+      ],
+      "Resource": [
+        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts/*",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:GetSecretValue",
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:CreateSecret",
+        "secretsmanager:PutSecretValue",
+        "secretsmanager:DeleteSecret",
+        "secretsmanager:ListSecrets"
+      ],
+      "Resource": "arn:aws:secretsmanager:us-east-1:581513795199:secret:acdl/*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "sns:CreateTopic",
+        "sns:Publish",
+        "sns:GetTopicAttributes",
+        "sns:SetTopicAttributes",
+        "sns:DeleteTopic",
+        "sns:ListTopics"
+      ],
+      "Resource": "arn:aws:sns:us-east-1:581513795199:acdl-*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ce:GetCostAndUsage",
+        "ce:GetCostForecast",
+        "ce:GetCostAndUsageWithResources",
+        "ce:GetDimensionValues",
+        "ce:GetTags"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "kms:CreateKey",
+        "kms:CreateAlias",
+        "kms:Describe*",
+        "kms:Get*",
+        "kms:List*",
+        "kms:Update*",
+        "kms:Delete*",
+        "kms:EnableKey",
+        "kms:DisableKey",
+        "kms:ScheduleKeyDeletion",
+        "kms:TagResource",
+        "kms:UntagResource"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:CreateOpenIDConnectProvider",
+        "iam:GetOpenIDConnectProvider",
+        "iam:DeleteOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "iam:UpdateOpenIDConnectProviderThumbprint",
+        "iam:CreateRole",
+        "iam:GetRole",
+        "iam:ListRoles",
+        "iam:DeleteRole",
+        "iam:UpdateRole",
+        "iam:TagRole",
+        "iam:UntagRole"
+      ],
+      "Resource": "*"
     }
   ]
-}
+}