feat: build lambda worker image on worker-bridge base + register artifact

[sebasnallar]

What

Turns scopes-lambda into a real, publishable worker package.

Dockerfile — replaces the http-echo placeholder with the actual worker image:

• FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 (the lean gRPC worker bridge, ex-plugin-base-worker)
• adds the cloud tooling the lambda steps call: aws + opentofu + gomplate (bash/jq/np/base64 ship in the base)
• bakes the scope in and points the bridge at the lambda entrypoint + service-path via NP_* env
• verified locally: builds clean, and worker/tofu 1.7.2/aws 2.15.57/gomplate 3.11.7/np all resolve

publish-image.yml — after the ECR push, register the image as a platform artifact:

• new publish-artifact job needs: publish, consumes the build job's image_digest output
• np artifact create --type oci_image --registry public.ecr.aws --repository nullplatform/scopes/lambda --digest <digest> --visible-to organization=*
• installs the alpha-packages np CLI (same build the scopes repo uses)

.dockerignore — keep .git/.github/worker-base/node_modules out of the image.

Required repo config (CI won't publish the artifact without these)

• Secret ARTIFACT_NP_API_KEY — np API key (wired into NULLPLATFORM_API_KEY)
• Variable NP_ARTIFACT_NRN — owner NRN for the artifact

Note

public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 is already pushed (multi-arch amd64+arm64).