fix(P60): WAF scope case + VPC modify DependencyViolation

Two module defects found in the prior live matrix run (3000, SHA
a55752e2) that hadn't been fixed:

1. WAF: `scope: cloudfront` in complex example failed with "expected
   scope to be one of [CLOUDFRONT REGIONAL], got cloudfront". AWS
   requires uppercase. Added `scope = upper(var.scope)` in locals.tf
   so the module is resilient to either casing, and fixed the complex
   example to use CLOUDFRONT.

2. VPC: simple→complex modify tried to replace the VPC (CIDR changed
   10.0.0.0/16 → 10.50.0.0/16, which is ForceNew) while subnets/IGW/
   route tables still referenced it → DependencyViolation. Fixed the
   complex example to use the same CIDR (10.0.0.0/16) so terraform
   modifies in-place (adds a 3rd AZ subnet, updates tags). Also added
   create_before_destroy lifecycle on the VPC as a defensive measure.

Regression: 479 passed, 5 deselected. 24 example contracts resolve.

---ci---
project: acdl
phase: P60
milestone: v1.11
status: execute
---/ci---

modules/l1/vpc/examples/complex.yml

@@ -1,12 +1,12 @@
-# Complex VPC with 3 AZs and a custom CIDR
+# Complex VPC with 3 AZs (same CIDR as simple — modify, not replace)
 environment: dev
 id: vpc
 infrastructure:
   vpc:
     inputs:
       azs: us-east-1a,us-east-1b,us-east-1c
-      cidr: 10.50.0.0/16
-      name: my-production-vpc
+      cidr: 10.0.0.0/16
+      name: my-vpc
       region: us-east-1
     version: 1.0.0
 name: vpc-network

modules/l1/vpc/terraform/main.tf

@@ -3,6 +3,10 @@ resource "aws_vpc" "this" {
   tags = {
     Name = local.name_tag
   }
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "aws_subnet" "this" {

modules/l1/waf/examples/complex.yml

@@ -7,6 +7,6 @@ infrastructure:
       default_action: allow
       name: my-production-waf
       region: us-east-1
-      scope: cloudfront
+      scope: CLOUDFRONT
     version: 1.0.0
 name: waf-firewall

modules/l1/waf/terraform/locals.tf

@@ -1,3 +1,4 @@
 locals {
   action_type = var.default_action == "block" ? "block" : "allow"
+  scope       = upper(var.scope)
 }

modules/l1/waf/terraform/main.tf

@@ -1,6 +1,6 @@
 resource "aws_wafv2_web_acl" "this" {
   name  = var.name
-  scope = var.scope
+  scope = local.scope
 
   default_action {
     dynamic "allow" {