fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)

workflows-src/deploy.yml: aws-region now ${{ secrets.AWS_DEFAULT_REGION ||
'use-east-1' }} (was hardcoded us-east-1); platform checkout ref v1.25
(was v1.9, matching the consumer's @v1.25 pin). scripts/run_platform.sh
local fallback: unset raw NOVA_AWS_* + NOVA_GITEA_TOKEN after sourcing
.env.secrets (only canonical AWS_* names remain in shell env — the v1.8
blocked_env_vars guard). Re-synced to .github + .gitea.

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---

tests/test_deploy_workflow_env_input.py

@@ -74,3 +74,44 @@ def test_run_platform_sh_has_environment_flag():
     assert "ENVIRONMENT_OVERRIDE" in text
     assert "NOVA_ENVIRONMENT_OVERRIDE" in text
     assert "ACDL_ENVIRONMENT_OVERRIDE" not in text
+
+
+def test_deploy_workflow_aws_region_from_secret_with_fallback():
+    """SPEC §5.2: aws-region is read from the AWS_DEFAULT_REGION secret (not
+    hardcoded). The ``|| 'us-east-1'`` fallback preserves backwards-compat
+    for consumers that haven't set the secret."""
+    text = GITHUB.read_text()
+    assert "aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}" in text
+    # The hardcoded us-east-1 for the configure-aws-credentials step is gone.
+    assert "aws-region: us-east-1" not in text
+
+
+def test_deploy_workflow_platform_checkout_ref_matches_milestone():
+    """SPEC §7.2: the platform checkout ref matches the consumer's @v1.25
+    pin (the current v1.26 milestone's floating tag)."""
+    import yaml
+    wf = yaml.safe_load(GITHUB.read_text())
+    if True in wf:
+        wf["on"] = wf[True]
+    deploy_job = wf["jobs"]["deploy"]
+    checkout_steps = [s for s in deploy_job["steps"]
+                      if "checkout" in s.get("uses", "")]
+    platform_checkout = next(
+        (s for s in checkout_steps if s.get("with", {}).get("path") == "platform"),
+        None)
+    assert platform_checkout is not None, "must have a platform repo checkout"
+    assert platform_checkout["with"]["ref"] == "v1.25", \
+        "platform checkout ref must be v1.25 (matching the consumer's @v1.25 pin)"
+
+
+def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
+    """SPEC §5.2: the local .env.secrets fallback must NOT leave raw
+    NOVA_AWS_* / the forge-token name in the shell env — only the
+    canonical AWS_* names. This is the v1.8 blocked_env_vars guard."""
+    text = (ROOT / "scripts" / "run_platform.sh").read_text()
+    # The fallback exports the canonical AWS_* names...
+    assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
+    assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
+    assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
+    # ...then unsets the raw NOVA_AWS_* + the forge-token name.
+    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text