DynamoDB: integration test for __hmac GSI key condition (needs DynamoDB Local infra)

[tobyhede]

Follow-up from #725 (EQL v3 in encryptedDynamoDB).

Summary

The adapter stores an equality term as <attr>__hmac so it can back a DynamoDB GSI key condition. Today that end-to-end claim is asserted only by inference — unit/e2e tests confirm the __hmac attribute is present and correctly shaped, but nothing stands up a real table with a GSI on the __hmac attribute and runs an actual KeyConditionExpression query.

Why it's a separate issue

There is currently no DynamoDB Local / testcontainers / localstack infrastructure anywhere in the repo, and packages/stack does not depend on the aws-sdk DynamoDB client — the adapter operates purely on in-memory attribute-map objects. So this isn't "add a test"; it's introducing DynamoDB Local + the aws-sdk dynamodb dep + CI wiring, which carries its own supply-chain/CI review surface. That's why it was kept out of #725 rather than ballooning that diff.

Scope

• Add DynamoDB Local (or testcontainers) to the test infra, gated so it doesn't slow the default unit lane.
• One integration test: create a table with a GSI keyed on <attr>__hmac, encryptModel an item, PutItem, then Query via KeyConditionExpression on the __hmac value produced by encryptQuery, and assert the item comes back.
• Cover both a top-level equality column and (optionally) a dotted-path one.

Acceptance

• A live-free (no ZeroKMS? — or creds-gated) integration test proving a __hmac attribute backs a real GSI key-condition query end-to-end.