feat: add /aws-lambda-debug workflow

[23seriy]

Summary

• Adds /aws-lambda-debug — read-only Lambda function diagnostics workflow
• Covers: function state/config, CloudWatch metrics (errors, throttles, duration p50/p95/p99, cold starts, concurrent executions), filtered log tail, DLQ/destinations, concurrency (reserved + provisioned), VPC/ENI/subnet IP exhaustion, event source mappings, layers + runtime deprecation, and IAM execution role permissions
• Flags: deprecated runtimes, env vars with secret-like key names, async functions without DLQ, poison-pill stream sources without bisect-on-error, over-privileged roles, function URL with no auth, and VPC cold-start risk
• Generates a severity-ranked Markdown report with verdict (🟢/🟡/🔴)
• Never prints environment variable values or log lines with credential patterns

Test plan

• Validate frontmatter: ./scripts/validate-repo.sh
• Run against a real Lambda: /aws-lambda-debug FUNCTION=<name> REGION=<region>
• Test with a VPC-attached function (VPC/ENI section)
• Test with an SQS/Kinesis event source mapping
• Confirm graceful degradation when jq is absent

🤖 Generated with Claude Code