feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87)

---ci---
project: acdl
phase: 32
milestone: v1.8
status: execute
---/ci---

- All 11 L1 primitives now have deletion_protection NFR (boolean, default true).
- Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true;
  omits it when false. Default is true when NFR is absent.
- L2 composition resolver propagates inputs.deletion_protection to all
  children NFRs. When false, all resources get deletion_protection=false.
- Stack schema updated with optional features object (deletion_protection,
  uptime_enabled).
- Contract schema description updated to document deletion_protection
  and uptime_enabled inputs.

Tests: +5 (307 -> 312). All pass.

modules/l1/alb/interface.json

@@ -62,6 +62,11 @@
       "type": "boolean",
       "description": "Enable TLS listener.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   },
   "resources": [

modules/l1/cloudfront/interface.json

@@ -64,6 +64,11 @@
       "type": "boolean",
       "description": "Enable encryption in transit (HTTPS only).",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   },
   "resources": [

modules/l1/ecr/interface.json

@@ -41,6 +41,11 @@
       "type": "string",
       "description": "Encryption type.",
       "default": "KMS"
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   }
 }

modules/l1/ecs-cluster/interface.json

@@ -36,6 +36,11 @@
       "type": "boolean",
       "description": "Enable CloudWatch log group encryption.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   }
 }

modules/l1/ecs-service/interface.json

@@ -78,6 +78,11 @@
       "type": "boolean",
       "description": "Enable CloudWatch log group encryption.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   },
   "resources": [

modules/l1/iam-role/interface.json

@@ -41,6 +41,11 @@
       "type": "boolean",
       "description": "Encryption is not applicable to IAM roles but included for standards compliance.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   }
 }

modules/l1/s3/interface.json

@@ -50,6 +50,11 @@
       "type": "string",
       "description": "SSE algorithm.",
       "default": "aws:kms"
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   }
 }

modules/l1/vpc/interface.json

@@ -46,6 +46,11 @@
       "type": "boolean",
       "description": "Encrypt VPC flow logs with KMS.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   },
   "resources": [

modules/l1/waf/interface.json

@@ -49,6 +49,11 @@
       "type": "boolean",
       "description": "Enable WAF logging.",
       "default": true
+    },
+    "deletion_protection": {
+      "type": "boolean",
+      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
+      "default": true
     }
   },
   "resources": [