Operations Lake Starter Kit

Scrubbed GitHub template for playbook 45 (draft). Clone via Use this template: https://github.com/FeatureFactory-io/ops-lake-starter

Not the live opsdl lake. Fill docs/lake-scope-contract.yaml (org: YOUR_ORG, aws_account: "000000000000", lake_repo: ops-lake-starter, empty repos: []) then cdk bootstrap + one OpsLakeDeploy mint, set GHA secrets AWS_DEPLOY_ROLE_ARN and OPSLAKE_GITHUB_PAT (never GITHUB_*), push main, run populate-lake.

Pins: SSE-KMS with S3 Bucket Keys; Streamlit on ECS Fargate + ALB (not App Runner); OIDC trusts both repo:{org}/{repo}:* and repo:{org}@*/{repo}@*:*.

ci is XOR. Do not copy live account IDs, PATs, webhook secrets, or findings from opsdl.