perf(layer): precompile Python sources in Lambda layers

[leandrodamascena]

Issue number: closes #8516

Summary

Changes

Precompile the final layer contents inside the existing Lambda runtime image, after dependency pruning. Keep the .py files so source inspection, tracebacks, and source fallback remain available.

Use checked-hash invalidation: timestamp caches were ignored in five of ten runtime/architecture combinations because ZIP packaging rounded source timestamps. Hash-based caches were used in all ten.

The canary now exercises parsing, JSON Schema validation, and source inspection, and rejects layer source recompilation before sending the deployment notification. Validation runs on Create; Delete and Update still work after a cache failure. Layer build changes also trigger the relevant CI checks.

User experience

Consumers keep the same imports and deployment process. In the Lambda experiment, Python 3.13 ARM64 median initialization fell from 1,176 ms to 827 ms with 512 MB, measured over three cold starts per variant. Gains depend on the imports and runtime.

Keeping both sources and bytecode increases uncompressed layer size by approximately 5–8 MB in the tested artifacts. Existing functions pinned to a layer version keep their current artifact.

Validation

• 17 new regression cases covering ZIP timestamp rounding, stale source detection, loader restoration, and canary failure/cleanup behavior.
• Layer, Parser, Batch, validation, and Tracer tests: 190 passed on each of Python 3.10 and 3.14.
• Earlier artifact comparison: 72 real Lambda invocations across Python 3.10–3.14 and both architectures, with 13 functional checks per invocation. Checked-hash caches caused zero layer source recompilations.
• Final canary: 30 real Lambda invocations covering Python 3.10 and 3.14 on both architectures, plus Python 3.13 ARM64 using the ZIP built by this Dockerfile. Valid caches passed; source-only layers failed creation as expected; warm and cold deletion events succeeded.
• Docker build, Ruff, mypy for the canary, Bandit, Xenon, and applicable pre-commit hooks passed. Temporary AWS resources were removed and their deletion verified.

The full production layer release pipeline has not been run for this branch.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.92%. Comparing base (556478f) to head (7c67768).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8520   +/-   ##
========================================
  Coverage    96.92%   96.92%           
========================================
  Files          317      317           
  Lines        15911    15911           
  Branches      1398     1398           
========================================
  Hits         15422    15422           
  Misses         353      353           
  Partials       136      136           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.