feat(P26): 3 platform pipelines + release job with semver/tag updates

Phase 26 — platform-pipelines-and-release-automation:

- platform-test.yml: PR pipeline (lint + unit-test + integration-test +
  schema-validation) replacing ci.yml for PRs; integration-test runs
  run_platform.sh --check-only for every contracts/*.yaml
- primitives-plan.yml: PR pipeline with matrix over all 9 L1 primitives
  (s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf)
- patterns-plan.yml: PR pipeline with matrix over all 2 L2 modules
  (static-assets, microservice)
- release.yml: push-to-main pipeline computing next semver tag (PATCH for
  regular phases, MINOR for milestone completions), updating floating
  MAJOR.MINOR + MAJOR tags, and creating GitHub releases
- run_primitive_plan.sh: plan-only/check-only runner for a single L1
  primitive (adapter compile + structure validation offline)
- run_pattern_plan.sh: plan-only/check-only runner for a single L2 pattern
  (environment check + contract validate + resolve + adapter + structure
  validation offline)
- contracts/microservice.yaml: sample consumer contract for the
  microservice L2 module (schema-compliant scalar inputs)
- instance.json for 8 L1 primitives (vpc, ecs-cluster, ecs-service,
  iam-role, alb, ecr, cloudfront, waf) so the primitives-plan matrix can
  run the adapter offline; s3 already had one
- tests/test_release_logic.py: unit test for semver computation
  (PATCH bump, MINOR bump on milestone, floating tag format)
- tests/test_pipeline_contract.py: 19 new tests validating the 4 platform
  workflows exist and conform (stages, matrices, triggers, permissions)

DEVIATION: The microservice pattern (run_pattern_plan.sh --check-only
microservice + run_platform.sh --check-only contracts/microservice.yaml)
fails at the adapter stage due to a pre-existing resolver ref-id mismatch
for multi-resource L1s (resolver emits ref:vpc.subnet_ids but the expanded
resource id is vpc-subnet). This predates Phase 26 and is out of scope for
pipeline automation; the static-assets pattern passes end-to-end. The
microservice contract is schema-valid and resolves correctly (11
resources); only the adapter compilation of multi-resource L1 refs fails.

VERIFICATION:
- bash scripts/run_ci.sh: PASS (lint + test + check-only)
- python3 -m pytest tests/ -v: 266 passed
- bash scripts/run_primitive_plan.sh --check-only s3: PASS
- bash scripts/run_pattern_plan.sh --check-only static-assets: PASS
- All 9 primitives pass run_primitive_plan.sh --check-only
- All instance.json validate against stack.schema.json

---ci---
project: acdl
phase: 26
milestone: v1.7
status: execute
---/ci---

modules/l1/cloudfront/instance.json

@@ -0,0 +1,50 @@
+{
+  "version": "1.0.0",
+  "stack": {
+    "name": "cloudfront",
+    "kind": "l1",
+    "depth": 1
+  },
+  "resources": [
+    {
+      "id": "cloudfront-originaccesscontrol",
+      "type": "aws:cloudfront:originaccesscontrol",
+      "module": "cloudfront@1.0.0",
+      "inputs": {
+        "name": "acdl-oac",
+        "origin_type": "s3",
+        "signing_behavior": "always",
+        "region": "us-east-1"
+      },
+      "outputs": {
+        "oac_id": {
+          "type": "string"
+        }
+      }
+    },
+    {
+      "id": "cloudfront-distribution",
+      "type": "aws:cloudfront:distribution",
+      "module": "cloudfront@1.0.0",
+      "inputs": {
+        "bucket_regional_domain_name": "acdl-spike-bucket.s3.us-east-1.amazonaws.com",
+        "price_class": "PriceClass_100",
+        "viewer_protocol_policy": "redirect-to-https",
+        "default_ttl": 3600,
+        "max_ttl": 86400,
+        "region": "us-east-1"
+      },
+      "outputs": {
+        "distribution_arn": {
+          "type": "arn"
+        },
+        "distribution_domain_name": {
+          "type": "string"
+        },
+        "oac_id": {
+          "type": "string"
+        }
+      }
+    }
+  ]
+}