feat(terraform): add code-based eval executors (LFE-9943)

[wochinge]

Summary

• Adds tenant-isolated Python and Node.js Lambda executors for code-based evals, packaged from bundled runner handlers.
• Wires the Langfuse Helm release to use the AWS Lambda code eval dispatcher and enables the code eval worker queue consumer behind a single module flag.
• Creates a dedicated no-internet executor VPC, Lambda IAM role, deny policy for function-code ENI management, and Langfuse IRSA invoke permissions.
• Documents the community-facing enablement path and exposes only the executor Lambda function names for debugging.

Linear

• LFE-9943

Major Decisions

• Keeps enable_code_based_eval_executors as the only code-based eval enable flag so community users do not have to coordinate separate infra and worker settings.
• Keeps the isolated eval VPC managed by the module, with only the CIDR block configurable to avoid customer network collisions.
• Exposes Lambda function names rather than ARNs or isolated VPC internals to avoid turning implementation details into public API.

Review Focus

• Lambda tenant isolation and no-egress VPC/security group setup.
• Helm environment wiring for dispatcher, function names, queue shard count, and worker concurrency.
• Public module interface changes in variables.tf, outputs.tf, and README docs.

[wochinge]

no need to review

[wochinge]

no need to review

[wochinge]

We could also kick out the VPC to make the setup easier - what do you think @Steffen911 ?

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fbb12ba98a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid plan-time archive generation for Lambda packages

Using data "archive_file" here makes packaging happen during terraform plan, but aws_lambda_function.filename is consumed during apply. In multi-phase workflows (separate plan/apply jobs or runners), that zip file often is not present at apply time, so Lambda creation fails with a missing artifact. The archive provider docs explicitly call out this behavior and recommend the archive_file resource when artifacts cannot be persisted between phases.

Useful? React with 👍 / 👎.