fix(ci): read CI VPC outputs from S3 state instead of artifacts

upload-artifact@v4 is not supported on Gitea (GHES). Each lifecycle job
now runs terraform init + terraform output against the CI VPC stack
(state in S3) to read the VPC outputs locally — no artifact passing.

Also removed setup-python from ci-vpc-apply (not needed — just terraform).

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

.github/workflows/modules-lifecycle.yml

@@ -9,7 +9,8 @@
 #
 # A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
 # modules (alb, ecs-service, rds, uptime) and destroyed after all tests complete.
-# The CI VPC is separate from the long-lived platform VPC.
+# The CI VPC is separate from the long-lived platform VPC. Outputs are read
+# from the S3 state by each lifecycle job (no artifact passing needed).
 name: acdl-modules-lifecycle
 
 on:
@@ -27,16 +28,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
       - name: Install Terraform 1.9.*
         run: |
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Install dependencies
-        run: pip install jsonschema pyyaml boto3
       - name: Apply CI VPC
         working-directory: terraform/ci-vpc
         env:
@@ -46,13 +42,6 @@ jobs:
         run: |
           terraform init -input=false -lock=false
           terraform apply -auto-approve -lock=false
-          terraform output -json > /tmp/ci-vpc-outputs.json
-          cat /tmp/ci-vpc-outputs.json
-      - name: Upload CI VPC outputs
-        uses: actions/upload-artifact@v4
-        with:
-          name: ci-vpc-outputs
-          path: /tmp/ci-vpc-outputs.json
 
   # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
   lifecycle:
@@ -75,11 +64,15 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Download CI VPC outputs
-        uses: actions/download-artifact@v4
-        with:
-          name: ci-vpc-outputs
-          path: /tmp
+      - name: Read CI VPC outputs
+        working-directory: terraform/ci-vpc
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: |
+          terraform init -input=false -lock=false
+          terraform output -json > /tmp/ci-vpc-outputs.json
       - name: Apply (simple)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
@@ -107,9 +100,6 @@ jobs:
     if: always()
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
       - name: Install Terraform 1.9.*
         run: |
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg