fix(deploy): studio static mount order + CI route-check for FastAPI _IncludedRouter

[quantamixsol]

Summary

• Root cause of Lambda CI failures since 2026-06-18: FastAPI 0.100+ wraps include_router registrations in _IncludedRouter objects that don't expose .path at the top app.routes level. The CI step was walking app.routes directly → found 0 studio routes → exited 1 on every run.
• Fix 1 (graqle/studio/app.py): Move app.mount("/studio/static", ...) to after all include_router() calls. Starlette resolves Mounts before APIRouters in route lookup, so mounting static first was shadowing /studio/api/* routes.
• Fix 2 (.github/workflows/deploy-lambda.yml): Replace flat app.routes walk with app.openapi()['paths'] which correctly traverses the full route tree including nested _IncludedRouter objects. Fallback flat-walk retained for Mount entries. Exception is now logged before falling back (sentinel MINOR fix). Locally verified: 90 total routes, 75 studio routes, all 4 required routes OK.

Test plan

• CI graqle-check job passes (Verify Studio routes register step exits 0)
• CI deploy job runs and updates cognigraph-api Lambda
• Smoke test: GET /studio/api/health returns 200 after deploy

🤖 Generated with Claude Code

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 2 modules affected

Module	Files Changed	Risk Level	Impact Radius
.github	1	🟡 T2	1
graqle	1	🟡 T2	1

Total blast radius: 2

---

🏛️ Governance Verdict

⚠️ WARN

• T2: Advisory warnings detected. Review recommended.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T2

• A Senior Engineer or above must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	2
Files Analyzed	2
Blocked	0
SHACL Violations	0
Verdict	WARN

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-06-23T16:02:19.087641+00:00}