feat(microvm): add lifecycle hook service

[edersonbrilhante]

Description

Adds the MicroVM lifecycle-hook service and the CI, release, and integration-test changes needed to exercise the complete provider flow.

• Adds the lambdas/services/microvm-lifecycle-hooks service with strict lifecycle-payload validation, runner-configuration consumption, process management, graceful shutdown, and the documented Node 24/s6 runtime contract.
• Registers, builds, tests, packages, and attests the lifecycle-hook Lambda in the Lambda and release workflows.
• Replaces the separate MicroVM and multi-runner-v2 MiniStack paths with the multi-runner-webhook example, which configures EC2 and MicroVM lanes behind one webhook deployment.
• Adds an extensible Python smoke harness with shared webhook lifecycle orchestration and provider-specific EC2 and MicroVM checks, including scale-up, pool, and scale-down coverage.
• Updates the example documentation, Terraform/OpenTofu lockfiles, and MiniStack workflow to use the unified smoke entrypoint.

Test Plan

• Lifecycle-hook unit tests for payload validation, lifecycle handling, process management, server behavior, storage, and timing.
• Lambda service formatting, linting, test, build, packaging, and artifact inspection.
• Terraform formatting, validation, TFLint, conflict checks, and git diff --check.
• Terraform and OpenTofu init -lockfile=readonly for the unified multi-runner-webhook example.
• No live AWS deployment was performed.

Related Issues

• Stacked on feat(compute-providers): add Lambda MicroVM provider #5255.
• Foundation and Terraform provider layers: feat(microvm): add Terraform provider #5413 and feat(microvm): add microvm example #5377.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/services/microvm-lifecycle-hooks/package.json

Package	Version	License	Issue Type
@aws-github-runner/storage-providers		Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-github-runner/storage-providers		Unknown	Unknown
npm/@types/node	^22.19.3	Unknown	Unknown
npm/esbuild	^0.27.0	Unknown	Unknown

Scanned Files

• .github/workflows/ministack.yml
• lambdas/services/microvm-lifecycle-hooks/package.json

[guicaulada]

I think we should align this parser with the payload produced by #5255. I tried passing the actual createMicrovmRunHookPayload output into parseRunRequest, and it was rejected both with and without a pinned image version: the producer always includes runnerTokenSsmPath, and can also include imageArn and imageVersion.

There also seems to be a path distinction we should preserve: the producer uses runnerConfigSsmPath for bootstrap settings and runnerTokenSsmPath for the JIT token, whereas this maps the former to SSM_TOKEN_PATH. Maybe a test that feeds the producer output directly into this parser would help keep the two contracts aligned. Is there a translation step I'm missing?