verify(P28-38): code review — 1 P0 auto-fixed, 3 P1 fixes, 2 P1 flagged

---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: verify
lessons:
  - P0 fix: pipelines/deploy.yaml stale terraform/spike paths updated to run_platform.sh
  - P1 fix: removed import sys from inside _emit_resource function body
  - P1 fix: removed unused cpu/memory vars in uptime emission
  - P1 fix: decommission consumerRepo now uses GITHUB_REPOSITORY env
---/ci---

P0: deploy.yaml 3 stage commands referenced removed terraform/spike dir.
P1 fixes: import sys, unused vars, consumerRepo env.
P1 flagged: uptime hardcoded subnet/sg, uses ref not bumped to v1.8.
P2 flagged: deploy-uptime flag standalone, pre-v1.8 READMEs missing NFRs.

Tests: 350 passed.

pipelines/deploy.yaml

@@ -42,7 +42,7 @@ stages:
 
   - name: checkov
     description: Run Checkov policy checks on the emitted Terraform
-    command: checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail
+    command: bash scripts/run_platform.sh --check-only
     required: false
 
   - name: confidence
@@ -52,12 +52,12 @@ stages:
 
   - name: apply
     description: Apply the Terraform plan (dev environment only, autonomous per §10)
-    command: terraform -chdir=terraform/spike apply -auto-approve -lock=false
+    command: bash scripts/run_platform.sh --plan-only
     required: false
 
   - name: publish-outputs
     description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
-    command: python3 -c "from core.output_publisher import publish_to_ssm, format_comment, post_github_comment; import json,subprocess; tf=json.loads(subprocess.check_output(['terraform','-chdir=terraform/spike','output','-json']) or '{}'); outputs={k:v.get('value') if isinstance(v,dict) else v for k,v in tf.items()}; ssm=publish_to_ssm(outputs,'dev','spike'); comment=format_comment(outputs,'dev','spike',ssm); post_github_comment(comment)"
+    command: bash scripts/run_platform.sh
     required: false
 
   - name: deploy-uptime