CCM-14200 - event driven callback delivery

[mjewildnhs]

Description

Implement the event-driven callback delivery pipeline. Replaces the placeholder lambda handler stub with a full implementation: an SQS-to-EventBridge Pipes enrichment Lambda (client-transform-filter-lambda) that validates, transforms, and routes CloudEvents to client webhook endpoints via EventBridge. A new mock-webhook-lambda is added for use in tests.

The integration test requires further work but is dependent on other PRs (#43 / #32)

Changes:

• Implements the client-transform-filter-lambda handler with full validation (CloudEvents + Zod), transformation (MessageStatus/ChannelStatus), observability (metrics, structured logging), and structured error handling
• Adds a mock-webhook-lambda that acts as a test webhook receiver, logging received callbacks to CloudWatch in a queryable format
• Adds an integration test suite (tests/integration/) that publishes SQS messages and verifies end-to-end callback delivery, alongside infrastructure Terraform changes to support the new pipeline.

Context

Required for phase 1 of 2-way-messaging.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming
• If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[mjewildnhs]

@copilot review

[Copilot]

@mjewildnhs I've opened a new pull request, #34, to work on those changes. Once the pull request is ready, I'll request review from you.

[rhyscoxnhs]

No real fundamental issues here. I've left some minor suggestions for improvements, but there's no need to block a merge for these.