feat: CI orchestrator — Lambda dispatch + Fargate routing + cancel

dispatch: receives Gitea webhook, routes by runs-on label to Fargate
  tasks (go/node/docker/godot) or Lambda executor (deploy).
  Path filter evaluation, DynamoDB run tracking, cancel via StopTask.
exec: lightweight Lambda for deploy-only jobs (S3 sync, ECS update).
SAM template: API Gateway + 2 Lambdas + DynamoDB + cleanup cron.

orchestrator/Makefile

@@ -0,0 +1,45 @@
+.PHONY: build build-dispatch build-exec tidy test-local deploy deploy-guided clean
+
+REGION ?= eu-west-1
+
+build: build-dispatch build-exec
+
+build-dispatch:
+	cd dispatch && GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -tags lambda.norpc -o bootstrap .
+	cd dispatch && zip -j function.zip bootstrap && rm bootstrap
+
+build-exec:
+	cd exec && GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -tags lambda.norpc -o bootstrap .
+	cd exec && zip -j function.zip bootstrap && rm bootstrap
+
+tidy:
+	cd dispatch && go mod tidy
+	cd exec && go mod tidy
+
+test-local:
+	cd deploy && sam local invoke DispatchFunction \
+		--template-file template.yaml \
+		--event ../test-event.json \
+		--region $(REGION)
+
+deploy:
+	cd deploy && sam build --template-file template.yaml && \
+	sam deploy \
+		--template-file .aws-sam/build/template.yaml \
+		--stack-name tinqs-ci \
+		--region $(REGION) \
+		--capabilities CAPABILITY_IAM \
+		--parameter-overrides \
+			GiteaToken=$${GITEA_TOKEN} \
+			Subnets=$${SUBNETS} \
+			SecurityGroup=$${SECURITY_GROUP} \
+		--resolve-s3 \
+		--no-confirm-changeset
+
+deploy-guided:
+	cd deploy && sam build --template-file template.yaml && \
+	sam deploy --guided --template-file .aws-sam/build/template.yaml --stack-name tinqs-ci
+
+clean:
+	rm -f dispatch/bootstrap dispatch/function.zip
+	rm -f exec/bootstrap exec/function.zip