fix(sqs,lambda): mint queue URLs per caller so SQS clients in Lambda reach Overcast

[Neaox]

Problem

An SQSClient inside a Lambda function could not reach the emulator: it resolved the endpoint from the QueueUrl and ignored AWS_ENDPOINT_URL entirely.

That is deliberate SDK behaviour. @aws-sdk/middleware-sdk-sqs's queueUrlMiddleware runs after endpoint resolution and swaps in the queue URL's origin:

if (!endpoint && input.QueueUrl && resolvedEndpoint && useQueueUrlAsEndpoint) {
  const queueUrlOrigin = new URL(new URL(input.QueueUrl).origin);
  if (resolvedEndpoint.url.origin !== queueUrlOrigin.origin) {
    context.endpointV2 = { ...resolvedEndpoint, url: queueUrlOrigin };
  }
}

The trap is !endpoint: that is the client config field, and AWS_ENDPOINT_URL never reaches it — it resolves through serviceConfiguredEndpoint → the ruleset's Endpoint parameter, so the field stays undefined and the queue URL wins. Only new SQSClient({ endpoint }) passed literally suppresses it. .NET and Java v1 use the queue URL as the request URI outright, so no client-side flag covers every runtime.

Combined with queueURL() minting from a single server-wide ExternalBaseURL(), a Lambda container — a sibling of Overcast, not a child — received http://localhost:4566/... and sent its SQS traffic to its own loopback.

Relationship to #319

#319 (ECS) landed first and extracted internal/containerendpoint, holding the container-side half of this fix. This PR is rebased onto it and uses that package rather than duplicating it: the SplitHorizonHosts config field, the docker.HostConfig.ExtraHosts field, and the URL-rewriting//etc/hosts helpers are all #319's now. What remains here is the half #319 could not do — internal/containerendpoint's own doc comment defers to it: "Minted at runtime by the container itself (CreateQueue, GetQueueUrl, ListQueues) — handled server-side, see internal/middleware."

What this PR adds

1. Per-request queue URLs (the server-side half). New middleware.ClientEndpoint stamps the origin the caller dialled, and SQS renders every wire-facing queue URL through it. X-Forwarded-Host aware. Requests arriving on a real AWS hostname fall through to the configured origin, so host-based addressing (#313) cannot mint a URL nobody on the machine can resolve. The stored form stays canonical, so persisted state does not inherit one caller's view.

2. Lambda wired onto internal/containerendpoint. ContainerRuntime now holds a *containerendpoint.Mapper, so function environment goes through RewriteURLs and containers are created with ExtraHosts() — the same treatment ECS tasks got in #319. The Runtime API address is already routable from Lambda containers, so it is passed to New directly rather than re-resolved.

Together these cover both ways a URL reaches a function: one it fetches itself now matches its own endpoint, and one baked in by a host-side deploy is rewritten or resolves via /etc/hosts.

Behaviour change

OVERCAST_HOSTNAME becomes the fallback for callers without a usable origin rather than a server-wide override. This is what makes the fix hold when it is set, and it fixes the mirror image of the same bug: the compose setup in docs/README.md recommends OVERCAST_HOSTNAME=overcast, which was handing host-side clients an overcast:4566 queue URL that does not resolve on the host.

Queue URLs minted on any origin are still accepted — only the queue name is read from them — so a queue created on one origin can be addressed from another. The CloudFormation integration test exercises exactly that.

Tests

Failing-first, then green:

• tests/integration/sqs/endpoint_addressing_test.go — caller-origin minting across three origins, cross-origin GetQueueUrl/ListQueues, AWS-hostname fallback.
• internal/services/lambda/container_endpoint_test.go — that the runtime actually routes env and container creation through the mapper. The mechanisms themselves are internal/containerendpoint's own tests, so these stay at the wiring level rather than duplicating them.

Two existing tests encoded the old server-wide semantics and were updated to the new contract, both keeping their original intent: TestCreateQueue_honorsHostname now pins fallback and caller-origin behaviour, and TestCreateStack_SQSQueueRefOutputIsUsableQueueURL compares the queue path rather than the exact origin — it still proves a stack-output URL from a different origin works.

Green locally on the rebased branch: full ./internal/..., full ./tests/..., make docs-check, and golangci-lint (v1.64.8, matching CI) over ./....

Drive-by

docs/services/lambda.md had duplicated frontmatter on main — a Markdown parser reads the first block, so the real description was shadowed by a degenerate description: "Lambda" and the second block rendered as body text. I scanned every doc; it is the only affected file, so a one-off rather than a tooling regression. Removed, since this PR already edits that file. Verified capgen --write-docs does not re-add it.