feat(P58): single platform VPC + deterministic env-aware state keys

EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to
terraform/platform, drops the vpc child from the microservice composition
(references the platform VPC via data source), and makes state keys
env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle).

Platform VPC (terraform/platform/main.tf):
- aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG
- Outputs: vpc_id, subnet_ids, ecs_security_group_id

Microservice composition (modules/l2/microservice/composition.json):
- Dropped the vpc child (no per-contract VPC ever again).
- Added data_sources block: platform_vpc → terraform_remote_state (platform).
- Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids.
- Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id.
- Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group.

Contract resolver (core/contract_resolver.py):
- Added environment to the stack instance (stack.environment).
- Added data_sources handling: pseudo-children with outputs but no resources.
- data_sources propagated through fragment merge to the final stack instance.

Adapter (adapters/terraform/adapter.py):
- State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware).
- Emits data "terraform_remote_state" "platform" block when data_sources present.
- ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>.

Tests (tests/test_adapter.py):
- test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate.
- test_adapt_emits_data_source_block: data.terraform_remote_state.platform.
- test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output.
- Updated existing state key assertion (spike/s3/dev/terraform.tfstate).

Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only
passes for both microservice (9 resources, no VPC) and static-assets (5 resources).

---ci---
project: acdl
phase: P58
milestone: v1.11
status: execute
---/ci---

modules/l2/microservice/composition.json

@@ -3,9 +3,8 @@
   "version": "1.0.0",
   "kind": "l2",
   "depth": 1,
-  "description": "A composition that references six L1 primitives to deploy an ECS Fargate microservice end-to-end.",
+  "description": "A composition that references five L1 primitives to deploy an ECS Fargate microservice end-to-end. The VPC is owned by the platform (terraform/platform) and referenced via data source — no per-contract VPC.",
   "children": [
-    {"id": "vpc", "module": "vpc@1.0.0"},
     {"id": "cluster", "module": "ecs-cluster@1.0.0"},
     {"id": "ecr", "module": "ecr@1.0.0"},
     {"id": "roles", "module": "iam-role@1.0.0"},
@@ -13,21 +12,22 @@
     {"id": "service", "module": "ecs-service@1.0.0"},
     {"id": "kms", "module": "kms-key@1.0.0"}
   ],
+  "data_sources": [
+    {"name": "platform_vpc", "type": "terraform_remote_state", "source": "platform", "outputs": ["vpc_id", "subnet_ids", "ecs_security_group_id"]}
+  ],
   "wires": [
-    {"from": "contract.inputs.bucket_name", "to": "vpc.inputs.cidr", "default": "10.0.0.0/16"},
-    {"from": "contract.inputs.name", "to": "vpc.inputs.name", "default": "app"},
     {"from": "contract.inputs.name", "to": "alb.inputs.name", "default": "app"},
-    {"from": "contract.inputs.region", "to": "vpc.inputs.region"},
     {"from": "contract.inputs.region", "to": "cluster.inputs.region"},
     {"from": "contract.inputs.region", "to": "ecr.inputs.region"},
     {"from": "contract.inputs.region", "to": "roles.inputs.region"},
     {"from": "contract.inputs.region", "to": "alb.inputs.region"},
     {"from": "contract.inputs.region", "to": "service.inputs.region"},
-    {"from": "vpc.outputs.subnet_ids", "to": "alb.inputs.subnets"},
-    {"from": "vpc.outputs.subnet_ids", "to": "service.inputs.subnets"},
+    {"from": "platform_vpc.outputs.subnet_ids", "to": "alb.inputs.subnets"},
+    {"from": "platform_vpc.outputs.subnet_ids", "to": "service.inputs.subnets"},
+    {"from": "platform_vpc.outputs.vpc_id", "to": "alb.inputs.vpc_id"},
+    {"from": "platform_vpc.outputs.ecs_security_group_id", "to": "service.inputs.security_group"},
     {"from": "cluster.outputs.cluster_arn", "to": "service.inputs.cluster_arn"},
     {"from": "ecr.outputs.repository_url", "to": "service.inputs.image"},
-    {"from": "roles.outputs.role_arn", "to": "service.inputs.security_group"},
     {"from": "alb.outputs.target_group_arn", "to": "service.inputs.lb_target_group_arn"},
     {"from": "contract.inputs.region", "to": "kms.inputs.region"},
     {"from": "kms.outputs.kms_key_arn", "to": "ecr.inputs.kms_key_arn"},