feat(terraform): reusable module for deploying the broker Lambda

[jmgilman]

Summary

• Adds a first-party Terraform module under terraform/ that provisions the published github-token-broker release as an AWS Lambda, with least-privilege IAM, a managed CloudWatch log group, and an optional AWS_IAM-auth Function URL.
• Amends reusable-release.yml to upload dist/checksums.txt as a release asset (prerequisite for the module's inline SHA256 verification on download).
• Extends Dependabot to the terraform ecosystem and adds .github/workflows/terraform.yml (fmt, matrix validate, tflint with AWS ruleset, trivy config scan, terraform-docs sync check) — all actions SHA-pinned, top-level permissions: {}.

Three ways to source the Lambda zip via lambda_artifact:

Field	When to use
release_version = "v1.0.0"	Default. Module runs gh release download + sha256sum --check on apply.
lambda_zip_path	Pre-downloaded zip for air-gapped flows.
lambda_source_s3	When the zip is staged to S3 out-of-band.

Validation enforces exactly one is set.

Examples shipped: basic (smallest viable config), function-url (Function URL + principal-scoped invoker permission), with-ssm-bootstrap (gated SSM parameter creation for first-time setup).

Inline SHA256 verification is defense-in-depth; gh attestation verify remains the canonical supply-chain check, documented prominently in terraform/README.md. checksums.txt will be present on all releases shipping from this PR onwards.

Executes Phase 5 of .journal/PLAN.md.

Test plan

Local validation performed on this branch:

• tofu fmt -check -recursive — clean
• tofu init -backend=false && tofu validate — module and all three examples
• tflint --init && tflint --recursive with AWS ruleset v0.47.0 — no findings
• trivy config --severity HIGH,CRITICAL . — 0 misconfigurations
• terraform-docs markdown table --output-check — README in sync

To be verified in CI by the new terraform.yml workflow:

• fmt / validate / lint / security / docs jobs all pass
• Moon CI still green (no regressions)
• CodeQL / Scorecard unaffected

Deferred follow-ups (tracked in PLAN.md open threads):

• Live AWS sandbox deploy of examples/basic — procedure documented in terraform/README.md; execute when a sandbox account is available.
• Author a terraform skill grounded in lessons from this phase.

🤖 Generated with Claude Code