fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures

Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
   testing, separate from the long-lived platform VPC. Created before
   VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
   destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
   passed to those modules via scripts/run_lifecycle_test.sh +
   run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
   the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
   passing) → ci-vpc-destroy (always runs).

8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
  globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
  doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
  (cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
  network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
  on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
  vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example

Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

scripts/run_lifecycle_destroy.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# scripts/run_lifecycle_destroy.sh — destroy an L1 module after lifecycle testing.
+#
+# Usage: run_lifecycle_destroy.sh <module> [ci-vpc-outputs.json]
+#
+# For VPC-dependent modules, injects CI VPC outputs into the complex contract
+# before destroy (so terraform can find the resources in the right VPC).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+MODULE="$1"
+CI_VPC_OUTPUTS="${2:-}"
+
+CONTRACT="modules/l1/${MODULE}/examples/complex.yml"
+
+VPC_DEPENDENT="alb ecs-service rds uptime"
+
+if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
+  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-complex.yml"
+  python3 -c "
+import yaml, json
+
+with open('$CONTRACT') as f:
+    contract = yaml.safe_load(f)
+
+with open('$CI_VPC_OUTPUTS') as f:
+    raw = json.load(f)
+
+vpc = {k: v['value'] if isinstance(v, dict) and 'value' in v else v for k, v in raw.items()}
+
+m = '$MODULE'
+inputs = contract['infrastructure'][m]['inputs']
+if m == 'alb':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['vpc_id'] = vpc.get('vpc_id', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+elif m == 'ecs-service':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+    inputs['cluster_arn'] = vpc.get('cluster_arn', '')
+elif m == 'rds':
+    inputs['subnet_ids'] = vpc.get('subnet_ids', '')
+elif m == 'uptime':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+    inputs['cluster_arn'] = vpc.get('cluster_arn', '')
+
+with open('$TMP_CONTRACT', 'w') as f:
+    yaml.dump(contract, f)
+"
+  CONTRACT="$TMP_CONTRACT"
+fi
+
+bash scripts/run_platform.sh --destroy "$CONTRACT"

scripts/run_lifecycle_test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# scripts/run_lifecycle_test.sh — run a single L1 module lifecycle test.
+#
+# Usage: run_lifecycle_test.sh <module> <example> [ci-vpc-outputs.json]
+#
+# This script wraps run_platform.sh for the modules-lifecycle pipeline.
+# If the module is VPC-dependent and a ci-vpc-outputs.json is provided,
+# it generates a temporary contract with the CI VPC outputs injected.
+#
+# The CI VPC is short-lived (created/destroyed by the pipeline), separate
+# from the long-lived platform VPC.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+MODULE="$1"
+EXAMPLE="$2"  # simple or complex
+CI_VPC_OUTPUTS="${3:-}"
+
+CONTRACT="modules/l1/${MODULE}/examples/${EXAMPLE}.yml"
+
+# VPC-dependent modules that need CI VPC outputs injected
+VPC_DEPENDENT="alb ecs-service rds uptime"
+
+# If the module is VPC-dependent and we have CI VPC outputs, inject them
+if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
+  # Generate a temporary contract with CI VPC outputs injected
+  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-${EXAMPLE}.yml"
+  python3 -c "
+import yaml, json, sys
+
+# Load the original contract
+with open('$CONTRACT') as f:
+    contract = yaml.safe_load(f)
+
+# Load CI VPC outputs (terraform output -json format: {key: {value: ...}})
+with open('$CI_VPC_OUTPUTS') as f:
+    raw = json.load(f)
+
+vpc = {k: v['value'] if isinstance(v, dict) and 'value' in v else v for k, v in raw.items()}
+
+vpc_id = vpc.get('vpc_id', '')
+subnet_ids = vpc.get('subnet_ids', '')
+sg_id = vpc.get('ecs_security_group_id', '')
+cluster_arn = vpc.get('cluster_arn', '')
+
+module_name = '$MODULE'
+inputs = contract['infrastructure'][module_name]['inputs']
+
+# Inject VPC-dependent inputs based on the module
+if module_name == 'alb':
+    inputs['subnets'] = subnet_ids
+    inputs['vpc_id'] = vpc_id
+    inputs['security_group'] = sg_id
+elif module_name == 'ecs-service':
+    inputs['subnets'] = subnet_ids
+    inputs['security_group'] = sg_id
+    inputs['cluster_arn'] = cluster_arn
+elif module_name == 'rds':
+    inputs['subnet_ids'] = subnet_ids
+elif module_name == 'uptime':
+    inputs['subnets'] = subnet_ids
+    inputs['security_group'] = sg_id
+    inputs['cluster_arn'] = cluster_arn
+
+with open('$TMP_CONTRACT', 'w') as f:
+    yaml.dump(contract, f)
+print('$TMP_CONTRACT')
+"
+  CONTRACT="$TMP_CONTRACT"
+fi
+
+# Run the platform lifecycle command
+bash scripts/run_platform.sh --apply "$CONTRACT"