fix(P30): temp dir isolation + forge-agnostic APIs + static-key override (P1-8, P1-9, S1)

---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---

P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.

Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.

tests/test_pipeline_contract.py

@@ -225,7 +225,8 @@ class TestRunPlatformStreaming:
         )
         assert result.returncode == 0
         assert "PLATFORM CHECK OK" in result.stdout
-        assert "--- emitted terraform/spike/main.tf ---" in result.stdout
+        assert "--- emitted" in result.stdout
+        assert "main.tf" in result.stdout
         assert "aws_s3_bucket" in result.stdout
 
     def test_check_only_quiet_suppresses_terraform(self):
@@ -236,7 +237,7 @@ class TestRunPlatformStreaming:
         )
         assert result.returncode == 0
         assert "PLATFORM CHECK OK" in result.stdout
-        assert "--- emitted terraform/spike/main.tf ---" not in result.stdout
+        assert "--- emitted" not in result.stdout
 
 
 class TestDeployPipelineSchema:
@@ -353,6 +354,20 @@ class TestDeployWorkflowConformance:
         assert wf["permissions"]["id-token"] == "write"
         assert wf["permissions"]["contents"] == "read"
 
+    def test_deploy_workflow_static_key_override_wired(self):
+        """S1: the static-key override must be wired to configure-aws-credentials
+        inputs (access-key-id/secret-access-key), not inert env vars."""
+        wf = _load_workflow(".gitea/workflows/deploy.yml")
+        deploy_job = wf["jobs"]["deploy"]
+        creds_step = next(
+            s for s in deploy_job["steps"]
+            if "configure-aws-credentials" in s.get("uses", "")
+        )
+        with_block = creds_step.get("with", {})
+        assert "access-key-id" in with_block, "S1: access-key-id input must be wired"
+        assert "secret-access-key" in with_block, "S1: secret-access-key input must be wired"
+        assert "role-to-assume" in with_block, "S1: role-to-assume must still be present (conditional)"
+
 
 class TestSampleContractVersioning:
     def test_sample_contract_uses_versioned_tag(self):