feat(P58): single platform VPC + deterministic env-aware state keys

EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to
terraform/platform, drops the vpc child from the microservice composition
(references the platform VPC via data source), and makes state keys
env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle).

Platform VPC (terraform/platform/main.tf):
- aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG
- Outputs: vpc_id, subnet_ids, ecs_security_group_id

Microservice composition (modules/l2/microservice/composition.json):
- Dropped the vpc child (no per-contract VPC ever again).
- Added data_sources block: platform_vpc → terraform_remote_state (platform).
- Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids.
- Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id.
- Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group.

Contract resolver (core/contract_resolver.py):
- Added environment to the stack instance (stack.environment).
- Added data_sources handling: pseudo-children with outputs but no resources.
- data_sources propagated through fragment merge to the final stack instance.

Adapter (adapters/terraform/adapter.py):
- State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware).
- Emits data "terraform_remote_state" "platform" block when data_sources present.
- ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>.

Tests (tests/test_adapter.py):
- test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate.
- test_adapt_emits_data_source_block: data.terraform_remote_state.platform.
- test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output.
- Updated existing state key assertion (spike/s3/dev/terraform.tfstate).

Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only
passes for both microservice (9 resources, no VPC) and static-assets (5 resources).

---ci---
project: acdl
phase: P58
milestone: v1.11
status: execute
---/ci---

adapters/terraform/adapter.py

@@ -35,24 +35,29 @@ def _module_name(resource):
     return resource.get("module", "").split("@")[0]
 
 
-def _ref_expr(value):
-    """Translate a `ref:<rid>.<output>` string to a Terraform module output interpolation
-    `module.<rid>.<output>`. Returns None if the value is not a ref."""
+def _ref_expr(value, data_source_names=None):
+    """Translate a `ref:<rid>.<output>` string to a Terraform interpolation.
+    
+    For module resources: `module.<rid>.<output>`.
+    For data sources (platform-owned): `data.terraform_remote_state.platform.outputs.<output>`.
+    Returns None if the value is not a ref."""
     if not isinstance(value, str) or not value.startswith("ref:"):
         return None
     body = value[len("ref:"):]
     rid, out_name = body.split(".", 1)
+    if data_source_names and rid in data_source_names:
+        return f"data.terraform_remote_state.platform.outputs.{out_name}"
     return f"module.{rid}.{out_name}"
 
 
-def _tf_value(value):
+def _tf_value(value, data_source_names=None):
     """Render a Python value as a Terraform expression fragment."""
     if isinstance(value, bool):
         return "true" if value else "false"
     if isinstance(value, (int, float)) and not isinstance(value, bool):
         return str(value)
     if isinstance(value, str):
-        ref = _ref_expr(value)
+        ref = _ref_expr(value, data_source_names)
         if ref is not None:
             return ref
         stripped = value.lstrip()
@@ -69,7 +74,7 @@ def _tf_value(value):
     raise ValueError(f"unsupported input value type {type(value).__name__}")
 
 
-def _emit_module_block(resource, terraform_dirs, repo_root):
+def _emit_module_block(resource, terraform_dirs, repo_root, data_source_names=None):
     """Emit a `module "<rid>" { source = ... ... }` block for one resource."""
     rid = resource["id"]
     name = _module_name(resource)
@@ -81,7 +86,7 @@ def _emit_module_block(resource, terraform_dirs, repo_root):
     for in_name, value in resource.get("inputs", {}).items():
         if in_name == "region":
             continue
-        lines.append(f"  {in_name} = {_tf_value(value)}")
+        lines.append(f"  {in_name} = {_tf_value(value, data_source_names)}")
     lines.append("}")
     return "\n".join(lines)
 
@@ -111,6 +116,7 @@ def adapt(stack_instance, out_dir):
 
     # --- terraform.tf: required_version + required_providers + S3 backend ---
     stack_name = stack.get("name", "spike")
+    environment = stack.get("environment", "dev")
     terraform_tf = (
         'terraform {\n'
         '  required_version = ">= 1.9, < 1.10"\n'
@@ -122,14 +128,30 @@ def adapt(stack_instance, out_dir):
         '  }\n'
         '  backend "s3" {\n'
         '    bucket = "acdl-tfstate-581513795199-us-east-1"\n'
-        f'    key    = "spike/{stack_name}/terraform.tfstate"\n'
+        f'    key    = "spike/{stack_name}/{environment}/terraform.tfstate"\n'
         '    region = "us-east-1"\n'
         '  }\n'
         '}\n'
     )
 
-    # --- main.tf: module instantiations + root outputs ---
-    parts = [_emit_module_block(r, terraform_dirs, repo_root) for r in resources]
+    # --- data sources: emit terraform_remote_state for platform-owned resources ---
+    data_source_names = stack_instance.get("data_sources", [])
+    data_blocks = []
+    if data_source_names:
+        data_blocks.append(
+            'data "terraform_remote_state" "platform" {\n'
+            '  backend = "s3"\n'
+            '  config = {\n'
+            '    bucket = "acdl-tfstate-581513795199-us-east-1"\n'
+            '    key    = "platform/terraform.tfstate"\n'
+            '    region = "us-east-1"\n'
+            '  }\n'
+            '}\n'
+        )
+
+    # --- main.tf: data blocks + module instantiations + root outputs ---
+    parts = list(data_blocks)
+    parts.extend(_emit_module_block(r, terraform_dirs, repo_root, set(data_source_names)) for r in resources)
     for out_name, out_spec in stack_outputs.items():
         if isinstance(out_spec, dict) and "from" in out_spec:
             rid = out_spec["from"]