* feat(terraform): migrate front-integrations to HCP Terraform
Freeze SAM CD and add Terraform for seahaven-prod (Lambdas, DynamoDB,
EventBridge, alarms) so HCP becomes the sole deploy path. Include prod
secret ARNs in the tfvars example for workspace wiring.
* fix(terraform): reject symlink sources in Lambda package build
