Anomaly detection using DuckDB SQL query and S3 file event trigger

Trigger a DuckDB SQL anomaly check on every new S3 file with Kestra, then email a CSV of the flagged rows. Event-driven, declarative, no extra infra.