ttl-reaper: production deploy parameters are recorded nowhere in the repo — a bare `make deploy` silently regresses prod

[scttfrdmn]

The correct production parameter set for spawn-ttl-reaper-production exists only in the deployed CloudFormation stack. Nothing in the repo records it, so a plain make deploy from a clean checkout silently regresses production.

The gap

lambda/ttl-reaper/Makefile defaults, versus what is actually deployed:

Var	Makefile default	Deployed (2026-07-31)	Effect of a bare make deploy
ROLE_ARNS	dev account only	dev + 942542972736	drops an account from coverage
DNS_ZONE_ID	''	Z0341053304H0DQXF6U4X	DNS teardown (#247) off
DNS_DOMAIN	''	spore.host	DNS teardown off
DNS_SWEEP	false	true	reconciliation sweep (#438) off
ACCOUNTS_TABLE_KEY_ARN	''	…key/48eefc31-…	registry Scan fails on the CMK
ALARM_TOPIC_ARN	''	…:spawn-sweep-alerts	alarms created but page nobody

There is no samconfig.toml, and .deploy-params.yaml is gitignored (.gitignore:34).

The last row is the sharpest: it would leave the #469 alarms present and green while wired to nothing — failure-shaped exactly like the blindness #469 was filed to remove.

Why this is the #468 class, not a new one

#468 fixed a parameter being unreachable from the Makefile. This is the same defect one level out: unreachable from version control. sam deploy marks any parameter it is not given as UsePreviousValue, which masks the problem on an update of an existing stack — and hides it until the stack is recreated or deployed elsewhere, when the template Default silently wins instead.

Options

1. Committed samconfig.toml — the idiomatic SAM answer; sam deploy reads it with no Makefile change. All values here are ARNs/IDs, not secrets. NOTIFY_URL (a Slack webhook) must stay out.
2. Update the Makefile defaults — smaller diff, but conflates "default" with "what production runs" and does not generalise to staging.

Either way the environment-specific values want to live per-environment, since deploy-staging shares these defaults today.

Acceptance

• A clean checkout can reproduce the current production configuration without reading the live stack.
• No Slack webhook committed.
• make deploy cannot silently disable the sweep or unwire the alarm topic.

Found while deploying #469 (PR #471): every value above had to be recovered with describe-stacks before it was safe to deploy at all.