feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format

EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with
the full versions/variables/locals/main/outputs split. Defaults previously
hardcoded in the adapter move into locals.tf.

Simple single-resource modules (7):
- kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults)
- ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning)
- ecs-cluster: aws_ecs_cluster (name default)
- iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf)
- rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults)
- waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules)
- uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf)

Multi-resource modules with intra-refs (4):
- vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf)
- ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf)
- alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf)
- cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf)

Registry: terraform_dir added to all 11 remaining entries.

Adapter fix: stack output format uses separate 'from' + 'output' fields
(not 'from': 'rid.output'). Fixed _emit_root_output to read both fields.

6 previously-skipped tests unblocked (run_platform.sh --check-only now
resolves static-assets.yml through the new module-assembled adapter).
Removed skip markers. Fixed test assertion (aws_s3_bucket → module).

Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules
pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass
terraform init + validate standalone.

---ci---
project: acdl
phase: P56b
milestone: v1.11
status: execute
---/ci---

tests/test_environment_check.py

@@ -87,7 +87,6 @@ class TestRunPlatformWireIn:
         assert "environment_check.py" in content
         assert "Step 0: environment onboarding check" in content
 
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_check_only_passes_with_dev_environment(self):
         import subprocess
         result = subprocess.run(

tests/test_pipeline.py

@@ -44,7 +44,6 @@ class TestPipelineIntegration:
         assert sig.band == "pass"
         assert sig.score >= 0.50
 
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_run_platform_check_only(self):
         result = subprocess.run(
             ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only"],
@@ -54,7 +53,6 @@ class TestPipelineIntegration:
         assert result.returncode == 0, f"stdout: {result.stdout}\nstderr: {result.stderr}"
         assert "PLATFORM CHECK OK" in result.stdout
 
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_run_platform_check_only_no_aws_creds(self):
         env = os.environ.copy()
         env.pop("AWS_ACCESS_KEY_ID", None)

tests/test_pipeline_contract.py

@@ -193,7 +193,6 @@ class TestRunCiScript:
         content = open(ROOT / "scripts/run_ci.sh").read()
         assert "CI PIPELINE OK" in content
 
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_run_ci_lint_and_check_only_pass(self):
         result = subprocess.run(
             ["bash", "-c",
@@ -218,7 +217,6 @@ class TestRunCiScript:
 
 
 class TestRunPlatformStreaming:
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_check_only_streams_emitted_terraform(self):
         result = subprocess.run(
             ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only"],
@@ -229,9 +227,8 @@ class TestRunPlatformStreaming:
         assert "PLATFORM CHECK OK" in result.stdout
         assert "--- emitted" in result.stdout
         assert "main.tf" in result.stdout
-        assert "aws_s3_bucket" in result.stdout
+        assert "module" in result.stdout
 
-    @pytest.mark.skip(reason="run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs (P56b)")
     def test_check_only_quiet_suppresses_terraform(self):
         result = subprocess.run(
             ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only", "--quiet"],