docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs

---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
  covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
  partial: []
---/ci---

v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).

Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs

Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)

Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md

Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.

.ciagent/REQUIREMENTS.md

@@ -357,31 +357,31 @@
 | REQ-74 | 27 | complete (v1.7.0) |
 | REQ-75 | 27 | complete (v1.7.0) |
 
-### v1.8 (active — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs)
+### v1.8 (complete — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs, tag `v1.8.0`)
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| REQ-76 | 28 | pending |
-| REQ-77 | 28 | pending |
-| REQ-78 | 29 | pending |
-| REQ-79 | 29 | pending |
-| REQ-80 | 30 | pending |
-| REQ-81 | 30 | pending |
-| REQ-82 | 30 | pending |
-| REQ-83 | 31 | pending |
-| REQ-84 | 31 | pending |
-| REQ-85 | 31 | pending |
-| REQ-86 | 32 | pending |
-| REQ-87 | 32 | pending |
-| REQ-88 | 33 | pending |
-| REQ-89 | 33 | pending |
-| REQ-90 | 33 | pending |
-| REQ-91 | 33 | pending |
-| REQ-92 | 34 | pending |
-| REQ-93 | 34 | pending |
-| REQ-94 | 34 | pending |
-| REQ-95 | 35 | pending |
-| REQ-96 | 35 | pending |
-| REQ-97 | 36 | pending |
-| REQ-98 | 36 | pending |
-| REQ-99 | 36 | pending |
+| REQ-76 | 28 | complete (v1.8.0) |
+| REQ-77 | 28 | complete (v1.8.0) |
+| REQ-78 | 29 | complete (v1.8.0) |
+| REQ-79 | 29 | complete (v1.8.0) |
+| REQ-80 | 30 | complete (v1.8.0) |
+| REQ-81 | 30 | complete (v1.8.0) |
+| REQ-82 | 30 | complete (v1.8.0) |
+| REQ-83 | 31 | complete (v1.8.0) |
+| REQ-84 | 31 | complete (v1.8.0) |
+| REQ-85 | 31 | complete (v1.8.0) |
+| REQ-86 | 32 | complete (v1.8.0) |
+| REQ-87 | 32 | complete (v1.8.0) |
+| REQ-88 | 33 | complete (v1.8.0) |
+| REQ-89 | 33 | complete (v1.8.0) |
+| REQ-90 | 33 | complete (v1.8.0) |
+| REQ-91 | 33 | complete (v1.8.0) |
+| REQ-92 | 34 | complete (v1.8.0) |
+| REQ-93 | 34 | complete (v1.8.0) |
+| REQ-94 | 34 | complete (v1.8.0) |
+| REQ-95 | 35 | complete (v1.8.0) |
+| REQ-96 | 35 | complete (v1.8.0) |
+| REQ-97 | 36 | complete (v1.8.0) |
+| REQ-98 | 36 | complete (v1.8.0) |
+| REQ-99 | 36 | complete (v1.8.0) |