[deploy-plugin DPB-27] deploy-aws (lambda variant, HTTP scope) + Story 2

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

LWA container path via the injected ContainerBuildPort; lambda-variant manifest (HTTP rows only; queue:consume unverified with the leaf-card note); optional ./pulumi subpath (Automation API) for provisioned infra; Story-2 assets with the OIDC role-trust snippet. Anti-scope: HTTP-only until the AWS event-semantics probes pass (OF-8, L-7).

Acceptance

• gate: ships only behind an AWS-PROBE-HTTP pass
• gate: no event-semantics claims anywhere in manifest or docs
• gate: conformance cells for claimed verdicts

Metadata

Dependencies: DPB-26
Delivery shape: probe-gated adapter, HTTP scope