feat(sf): wire replay-concordance Lambda into Saturday SF

[cipher813]

Summary

Companion to alpha-engine-backtester #138 (concordance Lambda implementation). Inserts the Saturday SF state that fires the weekly cheap-model concordance pipeline + IAM allowlists.

SF chain after this PR

```
... → EvalJudge{Weekly,FirstSaturday} → EvalRollingMean
→ CheckSkipRationaleClustering → RationaleClustering
→ CheckSkipReplayConcordance → ReplayConcordance
→ SaturdayHealthCheck → ...
```

Independent skip-gates per observability path

Flag	Effect
`skip_eval_judge: true`	bypass judge only
`skip_rationale_clustering: true`	bypass clustering only (rerouted from SaturdayHealthCheck → CheckSkipReplayConcordance in this PR)
`skip_replay_concordance: true`	bypass concordance only

Each Catch lands at `SaturdayHealthCheck` — eval observability, failures don't halt the pipeline.

Default ReplayConcordance payload

```json
{
"end_time_iso.$": "$$.Execution.StartTime",
"target_models": ["claude-haiku-4-5"],
"window_days": 56,
"max_artifacts": 150
}
```

• `max_artifacts=150` fits 900s Lambda timeout at ~3-5 sec / replay
• Production weekly cost: ~$0.08 (1 target × 150 cap × Haiku rates)
• Operator overrides via SF input for ad-hoc runs against different target models (e.g. `claude-sonnet-4-6` self-test)

IAM updates

• `github-actions-lambda-deploy.json` — `alpha-engine-replay-concordance` added to LambdaUpdate + LambdaInvokeCanary lists. Asymmetric-IAM-grant antipattern compliance — 4th Lambda this shape; durable `lambda:CreateFunction` grant from data fix(iam): grant lambda:CreateFunction + PassRole(lambda) for first deploys #165 already covers create + update.
• `deploy_step_function.sh` — SF role inline LambdaInvoke list updated with the new function ARN so SF can invoke it.

Test plan

• 8 new SF wiring tests; suite 451 → 459
  • States present (CheckSkipReplayConcordance + ReplayConcordance)
  • SkipRationaleClustering reroute (now → CheckSkipReplayConcordance)
  • RationaleClustering success + Catch reroute (same)
  • SkipReplayConcordance: skip_replay_concordance flag → SaturdayHealthCheck
  • ReplayConcordance: live alias, payload required fields, 900s timeout, success + Catch routes, retry posture
• Apply IAM via `apply.sh` on the live role (mostly a no-op since CreateFunction is already granted; the resource-list update is what's new)
• Run `deploy_step_function.sh` to push the new SF definition + inline policy
• First Sat SF run after backtester PR fix(backfill): filter universe writes by current constituents + escalate preflight #138 merges (and Lambda deploys via `bash infrastructure/deploy_concordance.sh`) fires the concordance state

🤖 Generated with Claude Code