#7241 fix(lambda): close the remaining contract validation gaps

Summary

• Closes the Lambda contract validation gaps raised in review on the v0.8.16 release PR (#7224), following #7216
• Fixes two real holes in code-source selection: hasS3 required both S3 fields, so a partial pair alongside imageUri read as "image only" and the stray field still reached AWS; and an imageUri with no packageType was accepted even though it then defaults to Zip
• Fixes the VPC guard, which only checked that both lists were supplied — supplying both with one empty passed and produced a partial update
• Adds the documented AWS bounds for alias names (1–128 plus the pattern that excludes all-digit names), descriptions (256), layer names (140 plus the name-or-ARN pattern), optional functionName on the event source mapping operations (1–256), and RemovePermission statement IDs (1–100 plus its own pattern, which allows a dot where AddPermission does not)
• Rejects structurally meaningless values: empty tag keys, empty Kafka bootstrap servers, more than one weighted routing entry, and a mapping supplying both an event source ARN and self-managed Kafka bootstrap servers

Every bound here is one the AWS Lambda API reference documents. Two review findings asked for constraints the reference does not state and were left alone — see the PR discussion for the reasoning.

Type of Change

• Bug fix

Testing

• 13 new boundary tests, 181 passing across the Lambda block, contracts, tools, and operations
• bun run type-check clean; all 39 check:audits pass, plus docs-manifest:check and the block-registry check
• 7,035 tests pass across the blocks, tools, and contracts suites
• Verified every added bound against the AWS Lambda API reference rather than inferring from sibling operations

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)