feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87)

---ci---
project: acdl
phase: 32
milestone: v1.8
status: execute
---/ci---

- All 11 L1 primitives now have deletion_protection NFR (boolean, default true).
- Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true;
  omits it when false. Default is true when NFR is absent.
- L2 composition resolver propagates inputs.deletion_protection to all
  children NFRs. When false, all resources get deletion_protection=false.
- Stack schema updated with optional features object (deletion_protection,
  uptime_enabled).
- Contract schema description updated to document deletion_protection
  and uptime_enabled inputs.

Tests: +5 (307 -> 312). All pass.

schemas/stack.schema.json

@@ -32,6 +32,22 @@
           "minimum": 1,
           "maximum": 5,
           "description": "Composition depth (ARCHITECTURE.md §3: max depth 5). L2->L1 is depth 1."
+        },
+        "features": {
+          "type": "object",
+          "description": "Optional feature flags for L2 modules (e.g. deletion_protection, uptime_enabled).",
+          "properties": {
+            "deletion_protection": {
+              "type": "boolean",
+              "description": "When true (default), all children get deletion_protection NFR. Set to false to disable (used by decommission).",
+              "default": true
+            },
+            "uptime_enabled": {
+              "type": "boolean",
+              "description": "When true (default), the uptime monitoring stack is deployed after the L2 module.",
+              "default": true
+            }
+          }
         }
       }
     },