fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures

Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
   testing, separate from the long-lived platform VPC. Created before
   VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
   destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
   passed to those modules via scripts/run_lifecycle_test.sh +
   run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
   the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
   passing) → ci-vpc-destroy (always runs).

8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
  globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
  doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
  (cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
  network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
  on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
  vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example

Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

.github/workflows/modules-lifecycle.yml

@@ -7,8 +7,9 @@
 # This workflow implements pipelines/modules-lifecycle.yml (byte-identical
 # in .gitea/workflows/ and .github/workflows/).
 #
-# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
-# applied by a prerequisite job. Non-VPC L1s run independent.
+# A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
+# modules (alb, ecs-service, rds, uptime) and destroyed after all tests complete.
+# The CI VPC is separate from the long-lived platform VPC.
 name: acdl-modules-lifecycle
 
 on:
@@ -20,9 +21,9 @@ permissions:
   contents: read
 
 jobs:
-  # Prerequisite: apply the shared platform VPC (needed by VPC-dependent L1s)
-  platform-vpc-apply:
-    name: Platform VPC apply
+  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s)
+  ci-vpc-apply:
+    name: CI VPC apply
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -34,31 +35,29 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Configure AWS credentials
-        run: |
-          echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
-          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
-          echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV
-      - name: Apply platform VPC
-        working-directory: terraform/platform
+      - name: Install dependencies
+        run: pip install jsonschema pyyaml boto3
+      - name: Apply CI VPC
+        working-directory: terraform/ci-vpc
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform apply -auto-approve -lock=false \
-            -target=aws_vpc.acdl_shared \
-            -target=aws_subnet.acdl_shared \
-            -target=aws_internet_gateway.acdl_shared \
-            -target=aws_route_table.acdl_shared \
-            -target=aws_route_table_association.acdl_shared \
-            -target=aws_security_group.ecs
+          terraform apply -auto-approve -lock=false
+          terraform output -json > /tmp/ci-vpc-outputs.json
+          cat /tmp/ci-vpc-outputs.json
+      - name: Upload CI VPC outputs
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-vpc-outputs
+          path: /tmp/ci-vpc-outputs.json
 
   # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
   lifecycle:
     name: L1 lifecycle (${{ matrix.module }})
-    needs: platform-vpc-apply
+    needs: ci-vpc-apply
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -76,28 +75,33 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Download CI VPC outputs
+        uses: actions/download-artifact@v4
+        with:
+          name: ci-vpc-outputs
+          path: /tmp
       - name: Apply (simple)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
       - name: Modify (complex)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
       - name: Destroy
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
 
-  # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
-  platform-vpc-destroy:
-    name: Platform VPC destroy
+  # Cleanup: destroy the CI VPC (always runs, even if lifecycle fails)
+  ci-vpc-destroy:
+    name: CI VPC destroy
     needs: lifecycle
     runs-on: ubuntu-latest
     if: always()
@@ -111,18 +115,12 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Destroy platform VPC
-        working-directory: terraform/platform
+      - name: Destroy CI VPC
+        working-directory: terraform/ci-vpc
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform destroy -auto-approve -lock=false \
-            -target=aws_vpc.acdl_shared \
-            -target=aws_subnet.acdl_shared \
-            -target=aws_internet_gateway.acdl_shared \
-            -target=aws_route_table.acdl_shared \
-            -target=aws_route_table_association.acdl_shared \
-            -target=aws_security_group.ecs
+          terraform destroy -auto-approve -lock=false