Move the fastapi Lambda zip-size gate into the PR test suite

deploy_terraform.yml only triggers on push to dev/prod — by the time
it runs, the change has already merged to main and rolled into dev.
That's exactly how the size regression sat undetected for weeks: it
only ever surfaced deep inside terraform apply on dev.

Drop the fast_api_lambda_zip_size_check job from deploy_terraform.yml
and instead add tests/test_lambda_zip_size.py, which runs
backend/app/requirements/check_lambda_zip_size.py as part of the
existing pytest tests/ suite. ddd_tests.yml already runs that suite
on `pull_request: branches: ["**"]`, so this now fails the PR before
anything merges to main, rather than failing the dev deploy after.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/deploy_terraform.yml

@@ -534,26 +534,11 @@ jobs:
       TF_VAR_social_housing_wave_3_sharepoint_id: ${{ secrets.SOCIAL_HOUSING_WAVE_3_SHAREPOINT_ID }}
 
 
-  # ============================================================
-  # Check FastAPI Lambda package will fit AWS's unzipped size limit
-  # ============================================================
-  fast_api_lambda_zip_size_check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Check projected unzipped Lambda size
-        run: python3 backend/app/requirements/check_lambda_zip_size.py
-
   # ============================================================
   # Deploy FastAPI Lambda
   # ============================================================
   fast_api_lambda:
-    needs: [determine_stage, ara_engine_lambda, categorisation_lambda, postcodeSplitter_lambda, bulk_address2uprn_combiner_lambda, bulkUploadFinaliser_lambda, fast_api_lambda_zip_size_check]
+    needs: [determine_stage, ara_engine_lambda, categorisation_lambda, postcodeSplitter_lambda, bulk_address2uprn_combiner_lambda, bulkUploadFinaliser_lambda]
     uses: ./.github/workflows/_deploy_lambda.yml
     with:
       lambda_name: ara_fast_api

tests/test_lambda_zip_size.py

@@ -0,0 +1,42 @@
+"""Guard against the fastapi Lambda's unzipped package exceeding AWS's
+262144000 byte (250 MiB) limit.
+
+dev deployed with `InvalidParameterValueException: Unzipped size must be
+smaller than 262144000 bytes` for several weeks (2026-06-15 to 2026-07-03)
+before anyone noticed, because the failure only ever surfaced deep inside
+`terraform apply` on a push to dev/prod — well after a PR to main had merged.
+This runs the same check as part of the PR-gated test suite so a regression
+(e.g. a large fixture or dependency landing outside the Lambda's zip_excludes)
+fails the PR instead of the dev deploy.
+
+Runs the real `check_lambda_zip_size.py` script as a subprocess (not an
+in-process import) so this exercises exactly what a human or CI would run
+locally: `python3 backend/app/requirements/check_lambda_zip_size.py`.
+"""
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+CHECK_SCRIPT = REPO_ROOT / "backend/app/requirements/check_lambda_zip_size.py"
+
+
+def test_fastapi_lambda_unzipped_size_within_aws_limit() -> None:
+    result = subprocess.run(
+        [sys.executable, str(CHECK_SCRIPT)],
+        cwd=REPO_ROOT,
+        capture_output=True,
+        text=True,
+    )
+    print(result.stdout)
+    assert result.returncode == 0, (
+        "fastapi Lambda's projected unzipped size exceeds (or is dangerously "
+        "close to) AWS's 250 MiB limit — see output above. If this is a real "
+        "new dependency/fixture, either trim it or extend `zip_excludes` in "
+        "deployment/terraform/modules/lambda_with_api_gateway/variables.tf "
+        "(only if it's not needed by the Lambda at runtime).\n"
+        + result.stdout
+        + result.stderr
+    )