feat(P4): pipeline hardening — Checkov before plan, Wiz-or-Checkov on plan (REQ-250)

Two-stage policy scan per item 20:

1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev
   feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c
   (runs on the authored TF dir before plan, using --framework terraform).

2. Runtime policy scan on the plan AFTER terraform plan: Wiz when
   configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the
   plan as a drop-in replacement (--framework terraform_plan). Wiz and
   Checkov are NEVER both run on the plan. Replaces the old single
   Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh
   Step 5.

pipelines/contract.yml: stage list updated — 'checkov' stage replaced by
'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after
terraform-plan). 9 stages → 10 stages. Header comment updated.

adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan)
for scanning a terraform plan; backward-compat with the positional
<wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path.

Tests: test_pipeline_contract.py (9 → 10 stages, new stage names);
test_contract_resolver.py (rename test, assert checkov-static +
runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass
+ 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID
unset, unrelated to v1.21, fails on main without these changes too).

---ci---
project: acdl
phase: 4
milestone: v1.21
status: execute
phase_role: execution
---/ci---

pipelines/contract.yml

@@ -1,11 +1,19 @@
-# Nova Central Deployment Pipeline Contract (v1.8)
+# Nova Central Deployment Pipeline Contract (v1.8 + v1.21 REQ-250)
 #
 # This is the single source of truth for the deployment pipeline. It
 # declares the stages that run when a consumer submits a contract:
-#   validate-contract -> resolve-stack -> terraform-plan -> checkov ->
+#   validate-contract -> resolve-stack -> checkov-static (fail-fast) ->
+#   terraform-plan -> runtime-policy-scan (Wiz-or-Checkov, never both) ->
 #   confidence -> apply (dev only) -> publish-outputs -> deploy-uptime ->
 #   comment-outputs
 #
+# REQ-250 (v1.21): the policy scan is two-stage. checkov-static runs on
+# the authored Terraform code BEFORE terraform plan (fail-fast, quick
+# developer feedback). runtime-policy-scan runs AFTER terraform plan:
+# Wiz scans the plan when configured (WIZ_API_TOKEN + WIZ_API_URL);
+# otherwise Checkov runs against the plan as a drop-in replacement. Wiz
+# and Checkov are NEVER both run on the plan.
+#
 # Decommission mode (mode: decommission) runs a different set of stages:
 #   validate-change-request -> disable-deletion-protection (HITL SRE) ->
 #   zero-counts (HITL SRE) -> confirm-decommission
@@ -36,15 +44,20 @@ stages:
     command: python3 core/contract_resolver.py contracts/static-assets.yaml /tmp/acdl-stack.json
     required: true
 
+  - name: checkov-static
+    description: Run Checkov on the authored Terraform code (fail-fast, before terraform plan) — REQ-250
+    command: bash scripts/run_codegen.sh --check-only
+    required: true
+
   - name: terraform-plan
     description: Compile the stack to Terraform and run terraform plan
     command: bash scripts/run_platform.sh --plan-only contracts/static-assets.yaml
     required: true
 
-  - name: checkov
-    description: Run Checkov policy checks on the emitted Terraform
-    command: bash scripts/run_platform.sh --check-only
-    required: false
+  - name: runtime-policy-scan
+    description: Run Wiz against the plan when configured, else Checkov against the plan (never both) — REQ-250
+    command: bash scripts/run_postapply.sh contracts/static-assets.yaml --quiet
+    required: true
 
   - name: confidence
     description: Compute the confidence signal from policy + validation inputs