feat(lambda): stamp the deployed version, and gate that every deploy does (#654)

[scttfrdmn]

Closes #654's remaining scope.

What was left

spawn reaper deploy already stamped spawn:version for the self-hosted
reaper, and #670 added the comparison to spawn reaper status. The
spore.host-operated lambdas exposed nothing — no env var, no tag beyond
SAM's own, nothing in their source. I re-verified that against the live account
before starting rather than trusting the four-day-old comment.

Why it matters, stated precisely

Nothing synchronises the CLI with the control plane, so skew is the normal
state. That is defensible — they are independently deployed. What was not is
that it was invisible: answering "is the deployed reaper current?" meant
comparing a function's LastModified against git log -- lambda/<name>/.

That is archaeology, I did it by hand four times in one session, and it is
wrong in both directions — a redeploy carrying no source change moves
LastModified, and a source change never deployed does not.

The change

Six deploy mechanisms now stamp spawn:version, readable in one API call
without invoking the function:

mechanism	how	why that way
3 SAM templates	Version parameter → Tags	a tag CFN doesn't declare is stack drift, and the pipeline stack was just brought to IN_SYNC (#754)
3 shell deploys	aws lambda tag-resource	correct here precisely because they aren't CFN-managed

The value is git describe --tags --always --dirty, so a deploy from an
uncommitted tree stamps 0.126.1-1-gabc-dirty and says it was built from
uncommitted code instead of claiming a release.

The gate found things on its first run

scripts/lambda-version-census.sh, two halves mirroring
lambda-runtime-census.sh and verify-pins.sh. The offline half gates every PR,
checking two forms — YAML tag and tag-resource argument — because grepping
only templates is what left the script-deployed ones out.

A mechanism I had missed: scripts/deploy-custom-dns.sh deploys
spawn-dns-updater, but its own name says custom-dns, so enumerating by lambda
directory never sees it.

My networked half was wrong, and its first run proved it. It listed five
expected names. The account has sixteen functions — including
scheduler-handler with no spawn- prefix at all, plus prism-bot,
spore-bot, spore-rest-api. A hardcoded list reports a clean bill of health
for everything it forgot, which is the lesson lambda-runtime-census.sh already
records about github-oauth-bridge. It now enumerates.

Live state it surfaced, previously unavailable at a glance — six functions
last deployed in February 2026: alert-evaluator, both autoscale
orchestrators, cost-history-collector, and both dashboard-websocket functions.

An unstamped function reports ?, not a mismatch — the distinction
cmd/reaper_skew.go already draws between unknown and different.

Gates confirmed to fail on revert — after being fixed

Worth stating plainly: both matchers initially passed a deliberate revert.
grep -q spawn:version also matches the string in the parameter's own
Description and in the script's own echo, so the gate could never have fired.
Tightened to require the actual assignment (spawn:version: !Ref Version) and a
--tags value (--tags.*spawn:version=); both reverts now fail correctly.

The ERE also had to move off [^\n]* — grep treats the n as a literal, so that
class excludes the n in spawn:version and could never match.

All three templates pass sam validate --lint; ci.yml parses; root module,
docs-drift, changelog and semgrep --config=auto --error clean.

Deliberately not here

Moving the operated reaper off CloudFormation onto the pkg/reaperdeploy Go
path, which #654 prefers. That is a much larger change, and the version stamp is
the part that makes the skew visible — which was the actual complaint.

Also not here: redeploying anything. Every function keeps its current code;
the tags appear on each one's next deploy, which is why the census reports ?
rather than failing today.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!