fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures

Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
   testing, separate from the long-lived platform VPC. Created before
   VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
   destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
   passed to those modules via scripts/run_lifecycle_test.sh +
   run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
   the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
   passing) → ci-vpc-destroy (always runs).

8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
  globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
  doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
  (cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
  network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
  on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
  vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example

Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

modules/l1/alb/examples/complex.yml

@@ -1,14 +1,12 @@
-# Complex ALB with HTTPS + ACM cert (requires a consumer-supplied domain)
+# Complex ALB with HTTPS
 environment: dev
 id: alb
 infrastructure:
   alb:
     inputs:
-      name: my-production-alb
+      name: acdl-ci-alb
       port: 443
       protocol: HTTPS
       region: us-east-1
-      security_group: sg-xxx
-      subnets: subnet-aaa,subnet-bbb
     version: 1.0.0
-name: alb-loadbalancer
+name: alb-loadbalancer

modules/l1/alb/examples/simple.yml

@@ -3,11 +3,9 @@ id: alb
 infrastructure:
   alb:
     inputs:
-      name: my-alb
+      name: acdl-ci-alb
       port: 80
       protocol: HTTP
       region: us-east-1
-      security_group: sg-xxx
-      subnets: subnet-aaa,subnet-bbb
     version: 1.0.0
-name: alb-loadbalancer
+name: alb-loadbalancer

modules/l1/cloudfront/examples/complex.yml

@@ -1,15 +1,14 @@
-# Complex CloudFront with WAF + custom TTL + viewer protocol redirect
+# Complex CloudFront with custom TTL + viewer protocol redirect
 environment: dev
 id: cdn
 infrastructure:
   cloudfront:
     inputs:
       bucket_regional_domain_name: my-bucket.s3.us-east-1.amazonaws.com
-      default_ttl: 3600
+      default_ttl: 7200
       max_ttl: 86400
       price_class: PriceClass_100
       region: us-east-1
       viewer_protocol_policy: redirect-to-https
-      waf_web_acl_arn: arn:aws:wafv2:us-east-1:000000000000:webacl/my-waf
     version: 1.0.0
 name: cloudfront

modules/l1/ecs-service/examples/complex.yml

@@ -8,7 +8,7 @@ infrastructure:
         ENVIRONMENT: production
         LOG_LEVEL: info
       image: public.ecr.aws/docker/library/nginx:latest
-      name: my-production-service
+      family: acdl-ci-svc
       port: 8080
       region: us-east-1
     version: 1.0.0

modules/l1/ecs-service/examples/simple.yml

@@ -4,8 +4,8 @@ infrastructure:
   ecs-service:
     inputs:
       image: public.ecr.aws/docker/library/nginx:latest
-      name: my-service
+      family: acdl-ci-svc
       port: 80
       region: us-east-1
     version: 1.0.0
-name: ecs service
+name: ecs service

modules/l1/iam-role/examples/complex.yml

@@ -4,7 +4,7 @@ id: role
 infrastructure:
   iam-role:
     inputs:
-      name: my-production-task-role
+      role_name: acdl-ci-role
       region: us-east-1
     version: 1.0.0
 name: iam role

modules/l1/iam-role/examples/simple.yml

@@ -3,7 +3,7 @@ id: role
 infrastructure:
   iam-role:
     inputs:
-      name: my-task-role
+      role_name: acdl-ci-role
       region: us-east-1
     version: 1.0.0
 name: iam role

modules/l1/kms-key/terraform/locals.tf

@@ -0,0 +1,3 @@
+locals {
+  alias_name = "alias/acdl-ci-kms"
+}

modules/l1/kms-key/terraform/main.tf

@@ -5,6 +5,6 @@ resource "aws_kms_key" "this" {
 }
 
 resource "aws_kms_alias" "this" {
-  name          = "alias/acdl-${var.description != null ? var.description : "default"}"
+  name          = local.alias_name
   target_key_id = aws_kms_key.this.key_id
 }

modules/l1/rds/interface.json

@@ -9,7 +9,15 @@
       "type": "string",
       "description": "Database engine (postgres, mysql, mariadb, sqlserver, oracle).",
       "required": true,
-      "enum": ["postgres", "mysql", "mariadb", "sqlserver-ex", "sqlserver-web", "sqlserver-se", "oracle-se2"]
+      "enum": [
+        "postgres",
+        "mysql",
+        "mariadb",
+        "sqlserver-ex",
+        "sqlserver-web",
+        "sqlserver-se",
+        "oracle-se2"
+      ]
     },
     "engine_version": {
       "type": "string",
@@ -59,6 +67,12 @@
       "type": "string",
       "description": "ARN of the CMK for storage encryption; if absent, uses AWS-managed key.",
       "required": false
+    },
+    "subnet_ids": {
+      "type": "string",
+      "description": "Comma-separated subnet IDs for the DB subnet group",
+      "required": false,
+      "default": ""
     }
   },
   "outputs": {
@@ -88,4 +102,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/rds/terraform/main.tf

@@ -1,3 +1,9 @@
+resource "aws_db_subnet_group" "this" {
+  count      = var.subnet_ids != "" ? 1 : 0
+  name       = "acdl-ci-rds-subnet-group"
+  subnet_ids = split(",", var.subnet_ids)
+}
+
 resource "aws_db_instance" "this" {
   engine               = var.engine
   engine_version       = var.engine_version
@@ -10,4 +16,5 @@ resource "aws_db_instance" "this" {
   kms_key_id           = var.kms_key_arn
   skip_final_snapshot  = true
   publicly_accessible  = false
+  db_subnet_group_name = var.subnet_ids != "" ? aws_db_subnet_group.this[0].name : null
 }

modules/l1/rds/terraform/variables.tf

@@ -52,3 +52,9 @@ variable "kms_key_arn" {
   description = "ARN of the CMK for storage encryption; if absent, uses managed key."
   default     = null
 }
+
+variable "subnet_ids" {
+  type        = string
+  description = "Comma-separated subnet IDs for the DB subnet group (VPC-dependent)."
+  default     = ""
+}

modules/l1/s3/examples/complex.yml

@@ -3,7 +3,7 @@ id: s3a
 infrastructure:
   s3:
     inputs:
-      bucket_name: my-production-bucket
+      bucket_name: acdl-ci-s3a-complex
       region: us-east-1
     version: 1.0.0
 name: s3-bucket

modules/l1/s3/examples/simple.yml

@@ -3,7 +3,7 @@ id: s3a
 infrastructure:
   s3:
     inputs:
-      bucket_name: my-simple-bucket
+      bucket_name: acdl-ci-s3a-simple
       region: us-east-1
     version: 1.0.0
 name: s3-bucket

modules/l1/uptime/interface.json

@@ -56,6 +56,21 @@
       "description": "Memory for the ECS task in MB",
       "required": false,
       "default": 512
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet IDs for the ECS service ENIs",
+      "required": false
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group ID for the ECS service ENIs",
+      "required": false
+    },
+    "cluster_arn": {
+      "type": "string",
+      "description": "ECS cluster ARN to deploy the service into",
+      "required": false
     }
   },
   "outputs": {

modules/l1/uptime/terraform/locals.tf

@@ -9,4 +9,8 @@ locals {
       protocol      = "tcp"
     }]
   }])
+
+  subnet_list = var.subnets != "" ? split(",", var.subnets) : []
+  sg_list     = var.security_group != "" ? [var.security_group] : []
+  cluster_ref = var.cluster_arn != "" ? var.cluster_arn : "default"
 }

modules/l1/uptime/terraform/main.tf

@@ -9,8 +9,17 @@ resource "aws_ecs_task_definition" "uptime" {
 
 resource "aws_ecs_service" "uptime" {
   name            = "acdl-uptime"
-  cluster         = "default"
+  cluster         = local.cluster_ref
   task_definition = aws_ecs_task_definition.uptime.arn
   desired_count   = var.feature_flag_enabled ? 1 : 0
   launch_type     = "FARGATE"
-}
+
+  dynamic "network_configuration" {
+    for_each = length(local.subnet_list) > 0 ? [1] : []
+    content {
+      subnets          = local.subnet_list
+      security_groups  = local.sg_list
+      assign_public_ip = true
+    }
+  }
+}

modules/l1/uptime/terraform/variables.tf

@@ -50,3 +50,21 @@ variable "memory" {
   description = "Task memory (MiB, Fargate)."
   default     = 512
 }
+
+variable "subnets" {
+  type        = string
+  description = "Comma-separated subnet IDs for the ECS service ENIs."
+  default     = ""
+}
+
+variable "security_group" {
+  type        = string
+  description = "Security group ID for the ECS service ENIs."
+  default     = ""
+}
+
+variable "cluster_arn" {
+  type        = string
+  description = "ECS cluster ARN to deploy the service into."
+  default     = ""
+}