CI: lambda/* module tests don't run (root go test ./... skips submodules) #136

Summary

CI's Test job runs go test -short -coverprofile=coverage.out ./... from the root module only (.github/workflows/ci.yml:35). spawn has 11 separate Go modules under lambda/ (each its own go.mod), and go test ./... does not descend into them — so none of the Lambda modules' tests run in CI, and their code is invisible to codecov.

Modules currently untested by CI:

lambda/dns-updater          lambda/ttl-reaper           lambda/scheduler-handler
lambda/dashboard-api        lambda/alert-evaluator      lambda/alert-handler
lambda/dashboard-websocket  lambda/dashboard-websocket-processor
lambda/autoscale-orchestrator  lambda/cost-history-collector  lambda/sweep-orchestrator

Why it matters

• ttl-reaper is a cost-safety backstop; dns-updater writes Route53 records — both have real logic and tests that never execute in CI.
• Concretely: the Substrate Route53 test added for the account-name CNAME (feat(dns): register friendly account-name alias FQDN (#121 consumer / spore-host#357) #135) passes locally but would not run in CI, so a regression there wouldn't be caught.
• codecov patch-coverage is misleading: changes in lambda/* show as 0% / untracked because the test job never enters those modules.

Fix options

1. Matrix / loop over modules in the Test job: discover lambda/*/go.mod and go test ./... in each (and merge coverage profiles). Simplest, keeps modules independent.
2. A make test-all target that walks every module (go list -f '{{.Dir}}' -m won't cross modules; use a find . -name go.mod loop) and run that in CI.
3. Go workspace (go.work) — but that changes local dev ergonomics and the replace setup; probably more than needed.

Recommend option 1 or 2. Should also feed each module's coverage to codecov so lambda/* patches are measured.

Found via

#135 (account-name CNAME) — its Substrate Route53 test in lambda/dns-updater revealed the job never runs lambda-module tests.