fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)

workflows-src/deploy.yml: aws-region now ${{ secrets.AWS_DEFAULT_REGION ||
'use-east-1' }} (was hardcoded us-east-1); platform checkout ref v1.25
(was v1.9, matching the consumer's @v1.25 pin). scripts/run_platform.sh
local fallback: unset raw NOVA_AWS_* + NOVA_GITEA_TOKEN after sourcing
.env.secrets (only canonical AWS_* names remain in shell env — the v1.8
blocked_env_vars guard). Re-synced to .github + .gitea.

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---

.github/workflows/deploy.yml

@@ -82,7 +82,7 @@ jobs:
         with:
           repository: acdl/acdl
           path: platform
-          ref: v1.9
+          ref: v1.25
 
       - uses: actions/setup-python@v5
         with:
@@ -104,7 +104,7 @@ jobs:
         with:
           # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
           role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}
           access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}