verify(P1): state-bucket + Kyverno rebrand — 4-layer verify PASS + ship

VERIFY: structural — adapter.py:117 nova-tfstate-*; kyverno policy nova:*
labels; behavioral — 80 tests PASS + run_ci.sh 3-stage PASS; security —
emitted backend no longer points at a non-existent bucket; quality —
new test_adapt_emits_nova_state_bucket regression guard. REQ-165 complete.

---ci---
project: acdl
phase: 1
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-165]
  partial: []
---/ci---

tests/test_adapter.py

@@ -90,6 +90,15 @@ class TestModuleAssembly:
         assert 'backend "s3"' in terraform_tf
         assert 'spike/s3/dev/terraform.tfstate' in terraform_tf
 
+    def test_adapt_emits_nova_state_bucket(self, tmp_path):
+        """P1 (REQ-165): the emitted backend references nova-tfstate-*
+        (not acdl-tfstate-*); the live bucket was renamed in v1.15 P4."""
+        instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
+        adapt(instance, str(tmp_path))
+        terraform_tf = (tmp_path / "terraform.tf").read_text()
+        assert "nova-tfstate-" in terraform_tf
+        assert "acdl-tfstate-" not in terraform_tf
+
     def test_adapt_emits_root_outputs(self, tmp_path):
         instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
         instance["outputs"] = {