deploy: canary traffic-shifting via Lambda aliases

[jonmatum]

Priority: P2
Parent: #34

Context

Lambda deploys are all-or-nothing. A bad capture deploy is user-visible immediately.

Requirements

• Publish versioned Lambdas on every deploy (publish = true)
• Alias per function (live) with CodeDeploy deployment preference:
  • capture / enrich: Canary10Percent10Minutes
  • read-path: Linear10PercentEvery1Minute
• Pre-traffic hook runs the Lambda against a sample event; rolls back on failure
• API Gateway integrations point to the alias, not $LATEST

Acceptance criteria

• A deliberate broken deploy auto-rolls back before 100 % traffic shift
• Deploy time within acceptable bounds (CI surface no worse than +10 min)

Non-goals

• Full blue/green at the API Gateway level — alias traffic shifting is enough for v1

References

• Production readiness — consolidated plan (tracking) #34 (parent)