feat(microvm): add lifecycle hook service

[edersonbrilhante]

Description

• add a private lambdas/services/microvm-lifecycle-hooks service that packages the Lambda MicroVM lifecycle HTTP server as a self-contained NCC artifact
• preserve strict version 1 SSM payloads and add a strict version 2 context.storage environment map for per-MicroVM SSM or DynamoDB selection
• add provider-neutral runner-config consumers to storage-providers, including fail-closed SSM consumption and atomic unexpired DynamoDB consumption
• document the Node 24/s6 Docker build, whole-dist/ copy, rollout order, and least-privilege runtime requirements

This PR is stacked on #5279 because it consumes the shared DynamoDB runner-state schema introduced there.

Test Plan

• cd lambdas && yarn install --immutable
• NX_DAEMON=false NX_ISOLATE_PLUGINS=false yarn build
• NX_DAEMON=false NX_ISOLATE_PLUGINS=false yarn test
• NX_DAEMON=false NX_ISOLATE_PLUGINS=false yarn lint
• NX_DAEMON=false NX_ISOLATE_PLUGINS=false yarn format-check
• yarn tsc --noEmit -p services/microvm-lifecycle-hooks/tsconfig.json
• yarn tsc --noEmit -p libs/storage-providers/tsconfig.json
• copied the complete generated dist/ outside the workspace, started it, verified POST /aws/lambda-microvms/runtime/v1/ready, and exercised graceful shutdown

Related Issues

None.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/services/microvm-lifecycle-hooks/package.json

Package	Version	License	Issue Type
@aws-github-runner/storage-providers		Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-github-runner/storage-providers		Unknown	Unknown
npm/@types/node	^22.19.3	Unknown	Unknown
npm/@vercel/ncc	^0.38.4	Unknown	Unknown

Scanned Files

• lambdas/services/microvm-lifecycle-hooks/package.json