fix(P29): SSM fail-loud without CMK + Terraform-rendered invoke policy (P1-3, P1-6)

---ci---
project: acdl
phase: 29
milestone: v1.8
status: execute
---/ci---

P1-3: SSM publisher now raises RuntimeError when ACDL_KMS_KEY_ID is
unset. ACDL_ALLOW_DEFAULT_KMS=1 escape hatch for local testing.
P1-6: consumer_invoke_policy.json now uses ${account_id} and ${region}
placeholders. Terraform renders them via data.aws_caller_identity +
data.aws_region + replace() at apply time. No more hardcoded 000000000000.

Tests: +7 (285 -> 292). All pass.

terraform/platform/consumer_invoke_policy.json

@@ -4,7 +4,7 @@
     {
       "Effect": "Allow",
       "Action": "lambda:InvokeFunctionUrl",
-      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:acdl-contract-ingestor",
+      "Resource": "arn:aws:lambda:${region}:${account_id}:function:acdl-contract-ingestor",
       "Condition": {
         "StringEquals": {
           "aws:PrincipalTag/acdl:owner": "${consumerRepo}"

terraform/platform/main.tf

@@ -161,4 +161,25 @@ resource "aws_lambda_function" "contract_ingestor" {
 resource "aws_lambda_function_url" "contract_ingestor" {
   function_name      = aws_lambda_function.contract_ingestor.function_name
   authorization_type  = "AWS_IAM"
+}
+
+# P1-6: Render the consumer invoke policy with the live AWS account ID.
+# The JSON template (consumer_invoke_policy.json) uses ${account_id} and
+# ${region} placeholders. Terraform renders them at apply time using the
+# caller's live account ID — no hardcoded placeholder account IDs.
+data "aws_caller_identity" "current" {}
+
+data "aws_region" "current" {}
+
+locals {
+  invoke_policy_template = file("${path.module}/consumer_invoke_policy.json")
+  rendered_invoke_policy = replace(
+    replace(local.invoke_policy_template, "${account_id}", data.aws_caller_identity.current.account_id),
+    "${region}", data.aws_region.current.name
+  )
+}
+
+output "consumer_invoke_policy_rendered" {
+  value       = local.rendered_invoke_policy
+  description = "The consumer invoke policy JSON with the live account ID rendered. Distribute this to consumer accounts during onboarding."
 }