fix(iam): drop PutResourcePolicy from meal-order apply role

Pre-grant delivery.logs write via MealOrderApiAccessLogResourcePolicy on
substrate so the HCP apply role cannot mutate account-wide log resource
policies.

lib/terraform-substrate/terraform-substrate.template.yaml

@@ -1791,10 +1791,11 @@ Resources:
                 Action:
                   - logs:DescribeLogGroups
                 Resource: "*"
-              # HTTP API stage access_log_settings uses the Log Delivery APIs.
-              # These are account-level (Resource "*"); scoped log-group ARNs
-              # above are insufficient. Mirrors deploy-substrate
-              # cloudwatch-logs-management LogDelivery actions.
+              # HTTP API stage access_log_settings uses Log Delivery APIs
+              # (account-level Resource "*"). PutResourcePolicy is intentionally
+              # omitted: MealOrderApiAccessLogResourcePolicy below pre-grants
+              # delivery.logs.amazonaws.com on the meal-order API log group so
+              # the apply role cannot mutate account-wide log resource policies.
               - Sid: MealOrderApiGwAccessLogDelivery
                 Effect: Allow
                 Action:
@@ -1803,7 +1804,6 @@ Resources:
                   - logs:UpdateLogDelivery
                   - logs:DeleteLogDelivery
                   - logs:ListLogDeliveries
-                  - logs:PutResourcePolicy
                   - logs:DescribeResourcePolicies
                 Resource: "*"
               - Sid: StackBuckets
@@ -1941,3 +1941,36 @@ Resources:
                   - ses:GetIdentityVerificationAttributes
                   - ses:GetSendQuota
                 Resource: "*"
+
+  # Pre-grant delivery.logs write to the meal-order API access log group so
+  # hcptf-meal-order-manager does not need logs:PutResourcePolicy (account-wide).
+  # Deployed by CDK CFN exec on substrate update (PLAT-99).
+  MealOrderApiAccessLogResourcePolicy:
+    Type: AWS::Logs::ResourcePolicy
+    Condition: IsProdAccount
+    Properties:
+      PolicyName: MealOrderManagerApiAccessLogDelivery
+      PolicyDocument: !Sub |
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "AWSLogDeliveryWrite",
+              "Effect": "Allow",
+              "Principal": { "Service": "delivery.logs.amazonaws.com" },
+              "Action": [
+                "logs:CreateLogStream",
+                "logs:PutLogEvents"
+              ],
+              "Resource": [
+                "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/meal-order-manager",
+                "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/meal-order-manager:*"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "aws:SourceAccount": "${AWS::AccountId}"
+                }
+              }
+            }
+          ]
+        }