fix(terraform/platform): make Lambda conditional on zip existing

The Lambda function's filename attribute (contract_ingestor.zip) fails
during terraform apply when the zip doesn't exist (the lifecycle pipeline
only needs the VPC, not the Lambda). Made the Lambda + Function URL
conditional with count = fileexists('contract_ingestor.zip') ? 1 : 0.
The source_code_hash also uses the fileexists guard.

This lets the lifecycle pipeline apply only the VPC resources without
requiring the Lambda zip build artifact.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

terraform/platform/main.tf

@@ -137,14 +137,20 @@ resource "aws_iam_role_policy" "lambda_permissions" {
   })
 }
 
-# Lambda function
+# Lambda function (conditional — only created when contract_ingestor.zip exists)
+# The lifecycle pipeline only needs the VPC; the full platform deploy builds the zip first.
+locals {
+  lambda_zip_exists = fileexists("contract_ingestor.zip")
+}
+
 resource "aws_lambda_function" "contract_ingestor" {
+  count            = local.lambda_zip_exists ? 1 : 0
   function_name    = "acdl-contract-ingestor"
   handler          = "contract_ingestor.lambda_handler"
   runtime          = "python3.12"
   role             = aws_iam_role.lambda_exec.arn
   filename         = "contract_ingestor.zip"
-  source_code_hash = fileexists("contract_ingestor.zip") ? filebase64sha256("contract_ingestor.zip") : "placeholder"
+  source_code_hash = local.lambda_zip_exists ? filebase64sha256("contract_ingestor.zip") : "placeholder"
 
   environment {
     variables = {
@@ -164,7 +170,8 @@ resource "aws_lambda_function" "contract_ingestor" {
 
 # Lambda Function URL (IAM auth — consumers invoke via SigV4)
 resource "aws_lambda_function_url" "contract_ingestor" {
-  function_name      = aws_lambda_function.contract_ingestor.function_name
+  count              = local.lambda_zip_exists ? 1 : 0
+  function_name      = aws_lambda_function.contract_ingestor[0].function_name
   authorization_type = "AWS_IAM"
 }