feat(lambda): add TypeScript SDK and CDK construct (#909)

* feat(lambda): add TypeScript SDK and CDK construct

Adds the client-side surface on top of the Phase 6a Lambda handler so
adopters can drive a deployed stack from Node without writing AWS-SDK
boilerplate:

- renderToLambda(opts) starts a Step Functions execution and returns a
  handle. Does NOT poll.
- getRenderProgress({ executionArn }) returns a snapshot of progress,
  frames rendered, cost (Lambda GB-seconds + SFN transitions), errors,
  and the final output object once Assemble completes.
- deploySite({ projectDir, bucketName }) content-addresses the project
  tree, tar.gzs it, and uploads to S3 with a HeadObject short-circuit so
  re-renders of the same tree skip the tar+PUT.
- validateDistributedRenderConfig throws a typed InvalidConfigError
  before StartExecution, so shape errors surface synchronously.
- computeRenderCost is exposed for callers who want to format cost out
  of band.

Also ships HyperframesRenderStack, an aws-cdk-lib L2 construct that
emits the same topology as examples/aws-lambda/template.yaml. Lives on
the ./cdk subpath export so SDK-only consumers don't pull aws-cdk-lib
into their runtime graph (declared as an optional peer dependency).

Tests: 24 new unit tests across the SDK plus 9 CDK synth / contract /
snapshot tests. All 83 tests in packages/aws-lambda/src pass.

* refactor(lambda): /simplify pass on the SDK + CDK PR

Pulls shared logic out so the SDK doesn't re-invent things the handler
and the producer already have:

- `formatExtension` extracted to packages/aws-lambda/src/formatExtension.ts.
  handler.ts and renderToLambda.ts both used identical 12-line copies of
  this switch.
- `PLAN_PROJECT_DIR_SKIP_SEGMENTS` is now exported from
  @hyperframes/producer/distributed. deploySite consumes it instead of
  its own duplicate SKIP_TOP_LEVEL set; the two lists were trivially
  identical and would have drifted silently.
- `FakeS3` + `drainBody` factored out of the two SDK test files into
  src/sdk/__fixtures__/fakeS3.ts. Drops ~110 lines of test-file
  duplication and gives future SDK tests a one-line FakeS3 import.
- S3 URI building in deploySite and renderToLambda routes through the
  existing `formatS3Uri` helper instead of inline `s3://...`
  concatenation; matches the convention already in handler.ts.

Net -133 lines across the touched files. All 83 aws-lambda tests still
pass; all 60 producer distributed tests still pass.

* fix(lambda): bump CDK test timeouts for CI cold-start synth

The bun:test default 5s timeout tripped the first CDK snapshot test
in CI when the cold-start `Template.fromStack(stack)` synth took ~5-8s
on the slowest GitHub Actions runner. Locally on a warm shell the
synth measures <1s, so the failure didn't reproduce until PR #909 hit
CI.

Two changes:

  - Both CDK test files cache one synth in `beforeAll(..., 30000)` and
    reuse the result across every test that uses the default props.
    Each individual test now runs in microseconds (pure assertions
    against the already-synthed template), so the 5s timeout no longer
    applies on the hot path.

  - The two contract tests that exercise non-default props
    (reservedConcurrency, projectName) still synth fresh per-test; they
    get a per-test `it(..., 30000)` timeout.

No behavior changes.

* fix(lambda): address PR review on SDK + CDK construct

Three correctness + ergonomics fixes raised in Vai's review:

  - getRenderProgress over-counted SFN transitions by 3-5×. Step
    Functions Standard Workflows bill per state-entry, not per
    history event. Each Task produces ~5-7 history events
    (Scheduled / Started / Succeeded / TaskStateExited / …);
    counting `events.length` reported the runaway. Switch to
    counting `*StateEntered` events explicitly.

  - assembleComplete + outputFile detection was coupled to the
    Lambda payload's `Action` field. Move both signals onto the
    enclosing state name (`StateExited.name === "Assemble"`), which
    is the state-machine identity rather than the Lambda event
    contract. framesRendered increment moves to the same boundary
    (RenderChunk state).

  - SiteHandle now carries `bucketName` directly so README + CLI
    callers don't have to re-parse `projectS3Uri.split("/")[2]`.

Test updates: getRenderProgress tests wrap renderChunk/assemble
events in matching StateEntered + StateExited pairs so the new
state-name-driven dispatch is exercised end-to-end. SiteHandle
fixture in renderToLambda.test.ts gets the new bucketName field.

All 83 aws-lambda tests still pass.

packages/aws-lambda/src/sdk/costAccounting.ts

@@ -0,0 +1,91 @@
+/**
+ * Per-render cost accounting for {@link getRenderProgress}.
+ *
+ * AWS bills Lambda by **GB-seconds** (billed-duration × memory-in-GiB)
+ * and Step Functions standard workflows by **state transitions**. Both
+ * inputs are recoverable from the SFN execution history without an
+ * extra CloudWatch query — the history events carry
+ * `billedDurationInMillis` and `memorySizeInMB` on each Lambda
+ * invocation, and the transition count is simply `history.length`
+ * filtered to transition-worthy events.
+ *
+ * The math is documented inline so the constants stay close to the
+ * pricing source they came from. Cost is **best-effort**: AWS pricing
+ * varies by region + commitment plan; we use on-demand `us-east-1`
+ * rates as of 2026-05 and label the result `displayCost` so callers
+ * see the dollar value but downstream automation can also read the
+ * raw number.
+ */
+
+/** On-demand Lambda price, us-east-1, x86_64, on-demand: USD per GB-second. */
+const LAMBDA_USD_PER_GB_SECOND = 0.0000166667;
+/** Step Functions Standard Workflows, us-east-1: USD per state transition. */
+const SFN_USD_PER_TRANSITION = 0.000025;
+
+/** Raw history event subset the cost calc cares about. Caller filters from `getExecutionHistory`. */
+export interface BilledLambdaInvocation {
+  /** Millis of Lambda billed duration. Carried on `TaskSucceeded`/`TaskFailed` events. */
+  billedDurationMs: number;
+  /** Memory size in MB the function was configured with at invocation time. */
+  memorySizeMb: number;
+  /** `true` if the event payload did NOT carry a billed duration and we fell back to `Duration` or a constant. */
+  estimated: boolean;
+}
+
+/** Result of {@link computeRenderCost}. */
+export interface RenderCost {
+  /** USD accrued to date. */
+  accruedSoFarUsd: number;
+  /** Human-readable USD string, e.g. `"$0.0214"`. */
+  displayCost: string;
+  breakdown: {
+    lambdaUsd: number;
+    stepFunctionsUsd: number;
+    /** S3 transfer + storage cost varies by tier; we don't try to compute it here. */
+    s3Estimate: "not-included";
+    /** `true` if any Lambda invocation fell back to estimated billing. */
+    estimated: boolean;
+  };
+}
+
+/**
+ * Sum Lambda GB-seconds + SFN transitions into an aggregate USD figure.
+ *
+ * `stateTransitions` is the count of billable state-machine transitions
+ * — every successful state entry transitions once for standard
+ * workflows. Express workflows price differently and are out of scope.
+ */
+export function computeRenderCost(
+  lambdaInvocations: BilledLambdaInvocation[],
+  stateTransitions: number,
+): RenderCost {
+  let lambdaUsd = 0;
+  let anyEstimated = false;
+  for (const inv of lambdaInvocations) {
+    const gbSeconds = (inv.memorySizeMb / 1024) * (inv.billedDurationMs / 1000);
+    lambdaUsd += gbSeconds * LAMBDA_USD_PER_GB_SECOND;
+    if (inv.estimated) anyEstimated = true;
+  }
+  const stepFunctionsUsd = stateTransitions * SFN_USD_PER_TRANSITION;
+  const accruedSoFarUsd = roundUsd(lambdaUsd + stepFunctionsUsd);
+  return {
+    accruedSoFarUsd,
+    displayCost: formatUsd(accruedSoFarUsd),
+    breakdown: {
+      lambdaUsd: roundUsd(lambdaUsd),
+      stepFunctionsUsd: roundUsd(stepFunctionsUsd),
+      s3Estimate: "not-included",
+      estimated: anyEstimated,
+    },
+  };
+}
+
+function roundUsd(usd: number): number {
+  // Four decimal places — enough resolution for per-chunk granularity on
+  // a 10 GB Lambda. Anything finer is noise vs AWS' own rounding.
+  return Math.round(usd * 10_000) / 10_000;
+}
+
+function formatUsd(usd: number): string {
+  return `$${usd.toFixed(4)}`;
+}