v0.2.0 — CloudWatch Dashboard

Optional CloudWatch dashboard for pipeline observability, gated behind
enable_cloudwatch_dashboard = false (off by default). No Lambda code
changes — all metrics are derived from existing log output via metric filters.

New Resources (when enabled):

• 4 CloudWatch Metric Filters on the Lambda log group:
  • FilesRoutedToEgress — clean files moved to egress
  • FilesQuarantined — malware files quarantined
  • FilesLeftForReview — unsupported/failed scans left for manual review
  • ScanEventsSkipped — events with unexpected scan status
• 1 CloudWatch Dashboard with 7 widgets:
  • File Routing Outcomes (time series)
  • Routing Summary 24h (single value)
  • Lambda Invocations & Errors
  • Lambda Duration (average + p99)
  • Dead Letter Queue depth
  • S3 Object Counts (ingress/egress/quarantine)
  • S3 Bucket Sizes (ingress/egress/quarantine)

Custom metric namespace: {name_prefix}/SecureUpload

New Input:

• enable_cloudwatch_dashboard (bool, default false)

New Output:

• cloudwatch_dashboard_arn (null when disabled)

Security Notes:

• Metric filters operate on the existing Lambda log group and require no
  additional IAM permissions
• No changes to the Lambda function or its execution role

Testing:

• 31 validation tests (30 existing + 1 new dashboard_disabled_by_default)
• All CI checks pass (fmt, validate, validation tests)