Cache uv deps in deploy job and use uv pip install

[nathan-probert]

#98

CI/deploy hardening for repeated deploys:

• deploy job: adds the actions/cache on the uv cache (path now matches setup-uv's UV_CACHE_DIR, shared key with setup/lint/test) so deploys hit the shared wheel cache instead of re-downloading every time.
• deploy.sh: uv run pip install -> uv pip install for the Lambda vendoring (uv-native installer).
• deploy.yml: workflow-level concurrency group keyed on ref so overlapping runs serialize instead of double-deploying the same stack (previously caused ResourceConflictException: An update is in progress on UpdateFunctionCode when two runs of the same commit deployed concurrently).
• deploy.sh: update_lambda_code now captures and prints the real AWS error when a Lambda code update fails (was swallowed by &>/dev/null), so failures are diagnosable at a glance.

Verified: all four Cache uv steps (setup/lint/test/deploy) restore at ${{ runner.temp }}/setup-uv-cache, no more "cache path does not exist" warnings.