fix(iam): allow payroll schedule invoke under the paychex boundary (PLAT-228) (#155)

The live boundary denies lambda:InvokeFunction, so the Monday and Thursday
schedules would be created and would not fire. Allow that action only on
paychex-payroll-schedule, and allow SendMessage on paychex-checkcomponents
so the schedule role can enqueue the flush.

lib/deploy-substrate/deploy-substrate.template.yaml

@@ -146,7 +146,7 @@ Description: >-
 #     seahaven-lambda-execution-boundary-meal-order-manager: 2530 / 11 statements (PLAT-135)
 #     seahaven-lambda-execution-boundary-seahaven-site: 1159 / 6 statements
 #     seahaven-lambda-execution-boundary-seahaven-door-unlock-api: measure after deploy (PLAT-76)
-#     seahaven-lambda-execution-boundary-paychex-integrations: GetSecretValue on six minted ARNs (PLAT-122)
+#     seahaven-lambda-execution-boundary-paychex-integrations: 3250 / 10 statements (PLAT-228)
 #   Dev copies are floor-only (691 / 4) via IsProdAccount, except
 #   meal-order-manager (PLAT-210): DynamoDB/S3/SSM/invoke plus the
 #   seahaven-dev slack-bot-token ARN. SNS, SQS (Paychex), and SES stay prod.
@@ -377,6 +377,10 @@ Resources:
 #     - CloudWatch Logs (floor)
 #     - no DynamoDB / EventBridge / S3 data plane / SES / KMS / VPC in the
 #       scaffold Terraform
+#     - lambda:InvokeFunction on function:paychex-payroll-schedule only
+#       (PLAT-228). No other function ARN.
+#     - sqs:SendMessage on paychex-checkcomponents so the schedule role can
+#       enqueue the Monday flush. Identity policies still name the queue.
   #
   #   afi-backup-monitor        (functions: afi-*)
   #     - secretsmanager:GetSecretValue on TWO exact prod secret ARNs
@@ -917,12 +921,21 @@ Resources:
             Resource:
               - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-webhook-events"
               - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-login-delay"
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-checkcomponents"
           - Sid: PaychexIntegrationsSns
             Effect: Allow
             Action:
               - sns:Publish
             Resource:
               - !Sub "arn:aws:sns:us-east-1:${AWS::AccountId}:site-alerts"
+          # Scheduler invoke role only. The identity policy names this one
+          # function; the boundary must not open any other function ARN.
+          - Sid: PaychexIntegrationsInvokeSchedule
+            Effect: Allow
+            Action:
+              - lambda:InvokeFunction
+            Resource:
+              - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:paychex-payroll-schedule"
 
   ProcurementIngestBoundary:
     Type: AWS::IAM::ManagedPolicy