feat: build lambda worker image on worker-bridge base + register artifact

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.github
+worker-base
+node_modules

.github/workflows/publish-image.yml

@@ -20,3 +20,32 @@ jobs:
       tag: ${{ github.ref_name }}
     secrets:
       aws_role_arn: ${{ secrets.AWS_ROLE_ARN_ECR_PUSH }}
+
+  # Register the pushed image as a platform artifact, pinned by its digest and
+  # visible to every organization — so `np package publish` / scope_definition
+  # can resolve it. Idempotent upsert: re-runs of the same digest return the
+  # same ids.
+  publish-artifact:
+    name: Register oci_image artifact
+    needs: publish
+    runs-on: ubuntu-24.04
+    env:
+      # np reads the key from NULLPLATFORM_API_KEY; supply it via the
+      # ARTIFACT_NP_API_KEY repository secret.
+      NULLPLATFORM_API_KEY: ${{ secrets.ARTIFACT_NP_API_KEY }}
+      # Owner NRN for the artifact (repository/organization variable). Making it
+      # globally visible additionally requires artifact permissions org-wide.
+      NP_ARTIFACT_NRN: ${{ vars.NP_ARTIFACT_NRN }}
+    steps:
+      - name: Install np CLI (alpha-packages build)
+        run: curl -s https://cli.nullplatform.com/install.sh | VERSION=alpha-packages sh
+
+      - name: Register scopes-lambda image artifact (visible to everyone)
+        run: |
+          np artifact create \
+            --nrn "$NP_ARTIFACT_NRN" \
+            --type oci_image \
+            --registry public.ecr.aws \
+            --repository nullplatform/scopes/lambda \
+            --digest "${{ needs.publish.outputs.image_digest }}" \
+            --visible-to "organization=*"

Dockerfile

@@ -1,5 +1,17 @@
-FROM hashicorp/http-echo:1.0.0
-
-CMD ["-text={\"status\":\"ok\",\"msg\":\"Hola mundo\"}", "-listen=:8080", "-status-code=200"]
+# syntax=docker/dockerfile:1
+#
+# scopes-lambda worker image — the AWS Lambda scope built on the lean gRPC
+# worker bridge. The bridge dials over gRPC and runs the bash entrypoint on each
+# package-exec action; this image adds the cloud tooling the lambda steps need
+# and bakes the scope in, so the package-exec channel needs no cmdline.
+FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0
 
+# Cloud tooling the lambda steps call (the bridge base stays minimal on purpose):
+# aws + opentofu (tofu) + gomplate. bash, jq, np, base64 and curl ship in the base.
+RUN apk add --no-cache aws-cli opentofu gomplate
 
+# Bake the scope in and point the bridge at the lambda entrypoint + service path.
+COPY . /app/pkg
+ENV NP_PACKAGE_NAME=scopes-lambda \
+    NP_SERVICE_PATH=/app/pkg/lambda \
+    NP_SCOPE_ENTRYPOINT=/app/pkg/lambda/entrypoint