isolate prod Lambda deploy permissions to main-only role

[HikaruEgashira]

Motivation

• The shared GitHub Actions OIDC role granted lambda:UpdateFunctionCode and was assumable by any workflow/branch (repo:plenoai/pleno-live:*), allowing branch pushes or modified workflows to update the production Lambda outside the controlled deploy flow.

Description

• Add a new IAM role aws_iam_role.github_actions_deploy whose OIDC trust policy is restricted to the main branch via repo:plenoai/pleno-live:ref:refs/heads/main in packages/infra/github-oidc.tf.
• Move production Lambda update permissions (lambda:UpdateFunctionCode, lambda:GetFunction, lambda:GetFunctionConfiguration) to the new deploy role and add an ecr-push policy for that role, keeping the original shared pleno-live-github-actions role for non-deploy automation.
• Expose the new role ARN via output "github_actions_deploy_role_arn" and update the production workflow .github/workflows/deploy-server.yml to assume arn:aws:iam::951872725222:role/pleno-live-github-actions-deploy for deploy operations.
• Files changed: packages/infra/github-oidc.tf and .github/workflows/deploy-server.yml.

Testing

• Ran git diff --check to ensure no whitespace or index errors and it passed.
• Searched with rg for github_actions_lambda|role-to-assume|ref:refs/heads/main|UpdateFunctionCode|pleno-live-github-actions-deploy to verify updated references and the changes were found as expected.
• Attempted terraform fmt packages/infra/github-oidc.tf but Terraform is not installed in this environment, so Terraform formatting/validation could not be executed here.

---

Codex Task