fix(lambda): isolate Docker build to prevent host node_modules corruption

The inner build script was running pnpm install directly on the
bind-mounted host workspace, overwriting macOS/Windows node_modules
with Linux-specific Prisma binaries. Now rsync sources to /build
inside the container and only copy the final zip back to the host.

Author: j5ik2o

tools/scripts/build-read-model-updater-lambda.docker-inner.sh

@@ -1,34 +1,43 @@
 #!/usr/bin/env bash
 # Run inside Docker (linux/amd64) — invoked by build-read-model-updater-lambda.sh
+#
+# /workspace is a bind-mount of the host repo. To avoid overwriting host
+# node_modules with Linux-specific binaries, we copy the source tree to
+# /build and perform all work there. Only the final zip is written back
+# to /workspace/dist/.
 set -euo pipefail
 
-cd /workspace
-
 export CI=true
 
 export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq
-apt-get install -y -qq zip
+apt-get install -y -qq zip rsync
 
 corepack enable && corepack prepare pnpm@9.15.9 --activate
 
+# --- Copy source to isolated build directory ---
+BUILD=/build
+rm -rf "${BUILD}"
+rsync -a --exclude node_modules --exclude .turbo --exclude dist /workspace/ "${BUILD}/"
+cd "${BUILD}"
+
 pnpm install --frozen-lockfile
 pnpm prisma:generate
 pnpm exec turbo build --filter=cqrs-es-example-js-rmu --filter=cqrs-es-example-js-bootstrap
 
-STAGE="/workspace/dist/lambda/read-model-updater/stage"
-ZIP="/workspace/dist/lambda/read-model-updater/function.zip"
-rm -rf "${STAGE}" "${ZIP}"
+STAGE="${BUILD}/dist/lambda/read-model-updater/stage"
+ZIP_TMP="${BUILD}/dist/lambda/read-model-updater/function.zip"
+rm -rf "${STAGE}" "${ZIP_TMP}"
 mkdir -p "${STAGE}/node_modules"
 
-pnpm dlx esbuild@0.25.0 /workspace/packages/bootstrap/src/lambda-rmu-handler.ts \
+pnpm dlx esbuild@0.25.0 "${BUILD}/packages/bootstrap/src/lambda-rmu-handler.ts" \
   --bundle \
   --platform=node \
   --target=node18 \
   --outfile="${STAGE}/index.js" \
   --external:@prisma/client
 
-NM="$(node -p "const p=require('path');const x=require.resolve('@prisma/client/package.json',{paths:['/workspace/packages/bootstrap']});p.join(p.dirname(x),'..','..')")"
+NM="$(node -p "const p=require('path');const x=require.resolve('@prisma/client/package.json',{paths:['${BUILD}/packages/bootstrap']});p.join(p.dirname(x),'..','..')")"
 cp -r "${NM}/@prisma" "${STAGE}/node_modules/"
 cp -r "${NM}/.prisma" "${STAGE}/node_modules/"
 
@@ -39,7 +48,12 @@ find "${STAGE}/node_modules" -name "introspection-engine-*" -delete 2>/dev/null
 find "${STAGE}/node_modules" -name "migration-engine-*" -delete 2>/dev/null || true
 
 cd "${STAGE}"
-zip -q -r "${ZIP}" .
+zip -q -r "${ZIP_TMP}" .
+
+# --- Write only the final artifact back to the host mount ---
+OUT_DIR="/workspace/dist/lambda/read-model-updater"
+mkdir -p "${OUT_DIR}"
+cp "${ZIP_TMP}" "${OUT_DIR}/function.zip"
 
-echo "Wrote ${ZIP}"
-ls -la "${ZIP}"
+echo "Wrote ${OUT_DIR}/function.zip"
+ls -la "${OUT_DIR}/function.zip"