feat(sf): wire counterfactual rule fit Lambda into Saturday SF

[cipher813]

Summary

Companion to alpha-engine-backtester #140 (counterfactual Lambda implementation). Closes the agent-justification triple end-to-end — all three signals now fire from the Saturday SF on the same trailing-8-week corpus.

SF chain after this PR

```
... → EvalJudge{Weekly,FirstSaturday} → EvalRollingMean
→ CheckSkipRationaleClustering → RationaleClustering
→ CheckSkipReplayConcordance → ReplayConcordance
→ CheckSkipCounterfactual → Counterfactual
→ SaturdayHealthCheck → ...
```

Three independent skip-gates

Each lands on the next signal's gate rather than SaturdayHealthCheck — skipping one signal doesn't bundle-skip the others:

Flag	Routes to
`skip_rationale_clustering: true`	`CheckSkipReplayConcordance`
`skip_replay_concordance: true`	`CheckSkipCounterfactual`
`skip_counterfactual: true`	`SaturdayHealthCheck`

Default Counterfactual payload

```json
{
"end_time_iso.$": "$$.Execution.StartTime",
"window_days": 56,
"max_depth": 3
}
```

No `target_models` — counterfactual doesn't replay against a target model; sklearn fits a tree on actual (input → decision) pairs.

IAM updates

• `github-actions-lambda-deploy.json` — `alpha-engine-replay-counterfactual` added to LambdaUpdate + LambdaInvokeCanary. Durable CreateFunction grant from data fix(iam): grant lambda:CreateFunction + PassRole(lambda) for first deploys #165 already covers create + update.
• `deploy_step_function.sh` — SF role inline LambdaInvoke list updated.

Test plan

• 8 new SF wiring tests; suite 459 → 467
  • States present (CheckSkipCounterfactual + Counterfactual)
  • SkipReplayConcordance reroute (now → CheckSkipCounterfactual)
  • ReplayConcordance success + Catch reroute (same)
  • SkipCounterfactual: skip_counterfactual → SaturdayHealthCheck
  • Counterfactual: live alias, payload required fields, 600s timeout, success + Catch routes, retry posture
• Apply IAM via `apply.sh` (resource-list update)
• Run `deploy_step_function.sh` to push the new SF definition + inline policy
• First Sat SF run after backtester feat(sf): PR 4c rolling-mean SF wiring + CloudWatch alarm #140 merges (and Lambda deploys via `bash infrastructure/deploy_counterfactual.sh`) fires the counterfactual state

Agent-justification dashboard surface

All five metrics emit under `AlphaEngine/Eval`:

Metric	Source
`agent_quality_score`	eval-judge
`agent_quality_score_4w_mean`	eval-rolling-mean
`agent_rationale_template_concentration`	clustering
`agent_cheap_model_concordance`	concordance
`agent_counterfactual_rule_fit`	counterfactual

🤖 Generated with Claude Code