4491d0fa72
EXECUTE stage. Adds --apply and --destroy modes to run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. Changes to scripts/run_platform.sh: - Added APPLY_ONLY and DESTROY_ONLY flags to arg parsing. - --apply <contract>: resolve -> adapter -> terraform init/validate/plan/ apply -auto-approve. HITL attestation gate runs before apply for qa/prod/dr (REQ-108). Prints terraform outputs after apply. Exits with PLATFORM APPLY OK. - --destroy <contract>: resolve -> adapter -> terraform init/validate/ destroy -auto-approve. Use --decommission <CR> for gated production teardown (D-070 two-step CR validation). Exits with PLATFORM DESTROY OK. - Updated usage header to document all 5 modes (check-only, plan-only, apply, destroy, default full e2e). - Existing --check-only and --plan-only modes preserved unchanged. Tests (tests/test_pipeline.py): - test_run_platform_apply_mode_parses: --apply parses without unknown flag. - test_run_platform_destroy_mode_parses: --destroy parses without unknown flag. - test_no_python_runs_terraform_apply_or_destroy: D-101 grep assertion — no .py file in scripts/ contains 'terraform apply' or 'terraform destroy'. Regression: 464 passed, 0 skipped, 5 deselected (slow). --check-only still works (no regression in existing modes). ---ci--- project: acdl phase: P57 milestone: v1.11 status: execute ---/ci---