Stand up Lambda deploy infrastructure for the vendored functions

[thpr]

Follow-up to #233. The vendored functions (s-read, s-replay, monitoring-relay, monitoring-watchdog) were copied build-critical files only — scripts/bundle-function.mjs, scripts/build-prisma-layer.mjs, and layers/prisma-runtime/. The deployment infrastructure was intentionally left behind and needs to be set up here.

Work

• Port the Lambda packaging/deploy infra from Inventory (infra/lambda-packaging.tf.example, scripts/deploy-org.sh, related Terraform).
• Wire deploy of the four functions + the shared prisma-runtime layer (version-locked to @prisma/client 7.8.0 — bump layer + both generators together).
• Provision/parameterize required env: MONITORING_DATABASE_URL, the Shopify ingest DB URL, the SNS topic for the relay, etc. (see each function's .env.example).
• CI: build + deploy pipeline on the Node 22 runtime (CI uses old nodejs20, Incoming functions need Nodejs22+ #226).

Depends on the monorepo wire-up issue landing first (functions must build before they can deploy).