feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)

core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated
across core/scripts/adapters/tests/workflows + .env/.env.secrets (key
rename, values stay). G-106 binding: run_platform.sh:288-289 +
regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback).
G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets:
refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github).
acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced).
.acdl/→.nova/ consumer path (resolver + deploy workflow + schema +
tests + docs). Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 2
milestone: v1.15
status: execute
---/ci---

scripts/push_consumer_image.py

@@ -3,7 +3,8 @@
 
 Steps performed by this script:
   1. Load AWS creds from /root/acdl/.env.secrets
-     (ACDL_AWS_ACCESS_KEY_ID, ACDL_AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION).
+     (NOVA_AWS_ACCESS_KEY_ID, NOVA_AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION;
+     dual-read ACDL_* fallback until P5).
   2. Create the ECR repo `acdl-microservice` if it doesn't exist
      (ecr:DescribeRepositories / ecr:CreateRepository). Region: us-east-1.
   3. Get the ECR login password (ecr:GetAuthorizationToken) and run
@@ -26,17 +27,26 @@ import pathlib
 
 import boto3
 
+# Repo root on sys.path so `from core import env` resolves to THIS package
+# (avoids editable-installed third-party `core` shadow).
+_REPO_ROOT = str(pathlib.Path(__file__).resolve().parent.parent)
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+
 
 REPO_ROOT = pathlib.Path(__file__).resolve().parent.parent
 ENV_FILE = REPO_ROOT / ".env.secrets"
-AWS_ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+AWS_ACCOUNT_ID = env.get_env("AWS_ACCOUNT_ID", "581513795199")
 AWS_REGION = "us-east-1"
 ECR_REPO_NAME = "acdl-microservice"
 IMAGE_TAG = "latest"
 
 
 def _load_env(path):
-    """Load ACDL_AWS_* + AWS_DEFAULT_REGION from a flat KEY=VALUE file."""
+    """Load NOVA_AWS_* (preferred) / ACDL_AWS_* (fallback) + AWS_DEFAULT_REGION
+    from a flat KEY=VALUE file (dual-read per G-106, until P5)."""
     creds = {}
     with open(path, "r") as fh:
         for line in fh:
@@ -54,11 +64,12 @@ def main():
         return 2
 
     creds = _load_env(ENV_FILE)
-    access_key = creds.get("ACDL_AWS_ACCESS_KEY_ID")
-    secret_key = creds.get("ACDL_AWS_SECRET_ACCESS_KEY")
+    # Dual-read: NOVA_* preferred, ACDL_* fallback (G-106, removed in P5).
+    access_key = creds.get("NOVA_AWS_ACCESS_KEY_ID") or creds.get("ACDL_AWS_ACCESS_KEY_ID")
+    secret_key = creds.get("NOVA_AWS_SECRET_ACCESS_KEY") or creds.get("ACDL_AWS_SECRET_ACCESS_KEY")
     region = creds.get("AWS_DEFAULT_REGION", AWS_REGION)
     if not access_key or not secret_key:
-        print("FAIL: ACDL_AWS_ACCESS_KEY_ID / ACDL_AWS_SECRET_ACCESS_KEY missing",
+        print("FAIL: NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY missing",
               file=sys.stderr)
         return 2