feat(aws-lambda): validate variables + 256 KiB Step Functions input cap

[jrusso1020]

What

Phase 9 PR 9.2 of the distributed rendering plan — add client-side validation for config.variables and a 256 KiB cap on the full Step Functions Standard execution input.

Why

PR 9.1 added variables to DistributedRenderConfig. Because SerializableDistributedRenderConfig = Omit<DistributedRenderConfig, "logger" | "abortSignal" | "producerConfig">, the field automatically flows through renderToLambda's execution input — but the SDK didn't validate it.

Two failure modes need catching at the SDK boundary, before any AWS call:

1. Non-JSON-safe values (BigInt, functions, Symbols, undefined leaves, Date instances) either throw at JSON.stringify time or round-trip silently corrupted. Without validation, callers see States.DataLimitExceeded or silently-wrong renders 50 ms after StartExecution.
2. Oversize payloads — Step Functions Standard caps execution input at 256 KiB. Users hit this most when they try to inline base64 media into variables instead of URL-referencing assets. PR 9.5's guide will document the convention; this PR enforces the limit at the SDK so the error message names the actual byte count, the cap, and points at the docs section.

How

• validateVariablesPayload walks the variables tree and throws on functions, Symbols, BigInts, non-finite numbers, undefined leaves, non-plain objects. Uses a typeof→message lookup table (instead of a switch) to keep cyclomatic complexity below the audit threshold.
• validateStepFunctionsInputSize measures Buffer.byteLength(JSON.stringify(input), "utf8") against MAX_STEP_FUNCTIONS_INPUT_BYTES = 256 * 1024. Measured in UTF-8 bytes (Step Functions' wire format), not UTF-16 code units.
• renderToLambda calls both validators before sfn.send(new StartExecutionCommand(…)).
• Both helpers + the constant are exported from @hyperframes/aws-lambda/sdk so adapters that build custom Step Functions inputs (PR 9.4's batch verb, future Temporal port) can reuse the gates.

The error message for the size violation links to the templates-on-lambda#working-with-large-variables docs section (lands in PR 9.5) so callers know to URL-reference media assets instead of inlining bytes.

Test plan

• Unit tests added — 10 tests covering variables-payload validation (functions, Symbols, BigInts, NaN/Infinity, undefined leaves, Date instances, nested arrays/objects, happy-path JSON round-trip).
• 4 tests for validateStepFunctionsInputSize covering under-cap accept, over-cap reject with byte-count in message, the 256-KiB constant, and non-serializable root.
• 3 tests for renderToLambda covering variables-through-Step-Functions-input roundtrip, oversize-input early-reject, BigInt-in-variables early-reject.
• bun test packages/aws-lambda/src — 100 pass (was 83, +17 new tests in PR 9.2).
• bunx oxlint + bunx oxfmt --check clean on changed files.
• bun run --cwd packages/aws-lambda typecheck clean.
• bunx fallow audit --base origin/main --fail-on-issues passes (no new findings beyond validateDistributedRenderConfig's pre-existing complexity warning).

This is part of a stack of 5 (+1 optional) PRs (9.1–9.6); this is PR 9.2.

🤖 Generated with Claude Code

---

Replaces #964 (auto-closed when its base branch was deleted during the squash-merge of #962).

[miguel-heygen]

Re-approved — same diff as #964, rebased onto main after stack merge cascade.

[vanceingalls]

Re-stamp on #976 — recreated from #964 (auto-closed when #962's base branch was deleted on merge). Same content per James, rebased onto main. Prior #964 review (4323426141) verdict + findings still apply: all 4 prior importants addressed in #964 (cycle detection via WeakSet, field="config" rename, JSON.stringify try/catch, MAX_STEP_FUNCTIONS_INPUT_BYTES JSDoc narrowed). Base now main so the stacked-PR CI gap closes; required CI workflows actually run on this head.

Re-stamp by Vai (post-#962-merge recreation)

[miguel-heygen]

Re-approved — same diff, force-push dismissed prior approval.

[vanceingalls]

Re-stamp on #976 post-force-push. Same content as prior approve (4323864216) per James's note. Base main, CI all green per author. All prior #964 findings remain addressed (cycle detection, field rename, JSON.stringify try/catch, JSDoc scope narrow).

Re-stamp by Vai (post-force-push)