feat: enable opensearch slow logging

[gbirman]

see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html

[claude]

Code review

Found 1 issue that needs to be addressed:

Missing CloudWatch Logs Resource Policy

Location: infra/stacks/opensearch/index.ts around line 163

The PR creates CloudWatch Log Groups and configures logPublishingOptions on the OpenSearch domain, but is missing a required aws.cloudwatch.LogResourcePolicy resource that grants the OpenSearch service (es.amazonaws.com) permission to write logs to CloudWatch.

Without this resource policy, the deployment will either:

• Fail with a ValidationException from AWS, or
• Silently fail to deliver logs (the log groups will exist but OpenSearch won't be able to write to them)

Required fix:

Add a CloudWatch Logs resource policy before the opensearchDomain resource. See:

• Pulumi LogResourcePolicy docs
• AWS OpenSearch Slow Logs documentation (linked in your PR description)

The policy needs to:

1. Grant es.amazonaws.com service principal the logs:PutLogEvents and logs:CreateLogStream actions
2. Target all three log group ARNs with :* suffix
3. Be added as a dependency to the opensearchDomain resource to ensure proper ordering

Reference:

macro/infra/stacks/opensearch/index.ts

Lines 162 to 164 in e560282

	},
	],
	tags,