feat: Implement distributed locking in build worker

[llama90]

Summary

• Implement BuildLockManager for distributed lock management
• Integrate distributed locking in build worker to prevent duplicate builds
• Add command configuration for lock requirements
• Fix GitHub PAT retrieval from Parameter Store with caching

Key Changes

• BuildLockManager: DynamoDB-based distributed locking with conditional writes
• Build Worker Integration: Acquire lock before processing, release on completion/failure
• User Notifications: Inform users when build is already in progress
• GitHub PAT Fix: Use Parameter Store instead of environment variable with proper caching
• Command Config: Centralized configuration for lock/cache requirements per command

Implementation Details

• Lock key format: {command}-{component}-{environment} (e.g., build-router-plt)
• Lock TTL: 10 minutes (auto-cleanup for stale locks)
• Lock statuses: ACQUIRED, COMPLETED, FAILED
• Conditional writes prevent race conditions

Test Plan

• Test single user triggering build - should succeed
• Test concurrent users triggering same build - second should see "already in progress"
• Verify lock is released on successful build
• Verify lock is released on failed build
• Confirm TTL cleans up stale locks after 10 minutes

🤖 Generated with Claude Code

In general, to fix “invocation of non‑function” errors, you either (1) ensure the imported/assigned value is actually a function, or (2) guard before calling it and handle the error path explicitly. Since we are constrained to changes within this file and cannot alter the ./config module or change existing imports, the appropriate approach is to validate getConfig at the call site and avoid calling it if it is not a function.

Concretely, in applications/chatops/slack-bot/src/shared/build-lock.ts, update the BuildLockManager constructor to:

1. Check that getConfig is a function before invoking it.
2. If it is not a function, throw a descriptive error (or log and throw) instead of calling it, preventing a cryptic “is not a function” crash.
3. Optionally give a type-safe fallback (e.g., never after throwing) so TypeScript remains happy, but that is not strictly necessary if we just throw and then use the result.

The minimal change is to replace:

constructor() {
  const config = getConfig();
  this.tableName = `${config.orgPrefix}-${config.environment}-chatbot-build-locks`;
}

with a constructor that:

• Validates typeof getConfig === 'function'.
• Throws an Error if the validation fails.
• Calls getConfig() only in the safe branch and uses the returned config as before.

No new imports are required; we can use the built‑in Error and existing logger if desired (but using Error alone is sufficient and keeps changes minimal).

---