feat(P4): Nova rebrand — AWS resource migration (REQ-163)

Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB,
Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy,
state bucket, ALB, VPC/subnet names). Lambda default table names → nova-*
(D-111). State bucket backend → nova-tfstate (-migrate-state documented).
New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback).
New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default).
acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures
updated; terraform validate + pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 4
milestone: v1.15
status: execute
---/ci---

tests/test_local_emulating_adapters.py

@@ -121,7 +121,7 @@ def test_local_s3_backend_rewrites_s3_to_local(tmp_path):
     tf = tmp_path / "terraform.tf"
     tf.write_text(
         'terraform {\n  required_version = ">= 1.9"\n  backend "s3" {\n'
-        '    bucket = "acdl-tfstate-x"\n    key = "spike/s.tfstate"\n'
+        '    bucket = "nova-tfstate-x"\n    key = "spike/s.tfstate"\n'
         '    region = "us-east-1"\n  }\n}\n'
     )
     backend.rewrite_terraform_tf(tf, "test-stack")