feat(P40): contract interpolation + environment JSON schema

---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---

Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):

Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
  expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
  supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
  ValueError (fail loud). Expansion is post-schema-validation,
  pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
  contract's environment field BEFORE schema validation so interpolation
  context is consistent.
- env context loaded via _load_env (self-contained, works as script +
  package import); 'environment' alias for env 'name' so
  ${env.environment} resolves.

Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
  region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
  (attested, thresholds 0.75/0.90/0.95, placeholder account_id with
  stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.

Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
  acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
  naming pattern (region + account id + environment).

Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).

core/environments/README.md

@@ -10,7 +10,17 @@ runner key — the platform manages all of that here.
 
 ## Files
 
-- `dev.json` — the default dev environment (autonomous, confidence ≥ 0.50).
+- `dev.json` — the default dev environment (autonomous, confidence >= 0.50).
+- `qa.json` — QA environment (attested, QA HITL gate, confidence >= 0.75).
+  Placeholder binding (replace account_id with the real QA account).
+- `prod.json` — Production environment (attested, SRE HITL gate, confidence >= 0.90).
+  Placeholder binding.
+- `dr.json` — DR environment (attested, SRE HITL gate, confidence >= 0.95).
+  Placeholder binding.
+
+All files validate against `schemas/environment.schema.json`. The qa/prod/dr
+placeholders use `account_id: 000000000000` with a stderr warning at load
+time (prompts real binding before deploying).
 
 ## How it is used
 

core/environments/dr.json

@@ -0,0 +1,17 @@
+{
+  "name": "dr",
+  "description": "DR environment — attested (SRE HITL gate, confidence >= 0.95). Placeholder binding; replace account_id with the real DR account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-dr-state",
+    "lock_table": "acdl-dr-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.3.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-dr-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.95
+}

core/environments/prod.json

@@ -0,0 +1,17 @@
+{
+  "name": "prod",
+  "description": "Production environment — attested (SRE HITL gate, confidence >= 0.90). Placeholder binding; replace account_id with the real prod account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-prod-state",
+    "lock_table": "acdl-prod-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.2.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-prod-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.90
+}

core/environments/qa.json

@@ -0,0 +1,17 @@
+{
+  "name": "qa",
+  "description": "QA environment — attested (QA HITL gate, confidence >= 0.75). Placeholder binding; replace account_id with the real QA account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-qa-state",
+    "lock_table": "acdl-qa-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.1.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-qa-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.75
+}