[codex] Automate Arcade production deployment

[JeremyDemers]

What changed

• Adds a production deployment job after the existing frontend and serverless CI jobs pass on main.
• Builds and updates only the arcade-prod-api Lambda, then verifies its health endpoint.
• Uses GitHub OIDC and a repository-specific least-privilege AWS role instead of stored access keys.
• Updates the workflow actions to their current major versions and documents continuous deployment.

Why

The production API was deployed manually. Merged application changes should reach AWS reproducibly without granting GitHub Terraform administrator access.

Impact

Pull requests remain test-only. A successful push to main deploys the Arcade Lambda code; infrastructure changes still require a reviewed local Terraform apply.

Validation

• actionlint passed
• YAML lint passed
• Lambda package built successfully
• 5 serverless API tests passed
• Least-privilege IAM simulation allows Lambda updates and denies unrelated S3 access