fix(hosting): disable installLatestAwsSdk on CDN invalidation custom resource

[soberm]

Problem

The DeployInvalidation AwsCustomResource in CdnConstruct
(packages/hosting/src/constructs/cdn_construct.ts) left installLatestAwsSdk
at its CDK default of true. With that default, the custom-resource provider
Lambda runs npm install for the AWS SDK at invoke time, which adds roughly
15-30s of cold start and forces a 512MB memory floor on the provider function.

Two things make this worse than a typical occurrence of the anti-pattern:

• The resource makes a single CloudFront.createInvalidation call — a
  long-stable API already bundled in the Lambda runtime's AWS SDK v3, so there
  is nothing to gain from a newer SDK.
• Unlike a one-off resource, this one fires on every hosting deploy (its
  CallerReference and physicalResourceId are keyed on buildId), so the
  install cost was paid on each deploy rather than once.

CDK also emits its installLatestAwsSdkNotSpecified warning for this construct
on every synth.

Sibling fix to #371 — same anti-pattern, different package. That PR covers the
bb-knowledge-base site; this one covers hosting. No overlap: this branch is
cut independently from origin/main and touches only packages/hosting.

Issue #, if available: n/a

Changes

• packages/hosting/src/constructs/cdn_construct.ts: add
  installLatestAwsSdk: false to the DeployInvalidation AwsCustomResource
  options, with a short comment recording the rationale.
• packages/hosting/src/constructs/cdn_construct.test.ts: add a test asserting
  the synthesized Custom::AWS carries InstallLatestAwsSdk: false.
• Changeset: @aws-blocks/hosting patch. @aws-blocks/blocks is intentionally
  not included — it has no dependency on @aws-blocks/hosting and does not
  re-export the construct.

Invalidation behavior, the IAM policy (cloudfront:CreateInvalidation on *),
and the deploy ordering dependency on the KVS cutover are all unchanged. The
only synthesized-template delta is the InstallLatestAwsSdk property flipping
from true to false. No public API surface change, so API.md is untouched.

Validation

Clean build (node 22.22.3), rm -rf dist *.tsbuildinfo && npm run build in
packages/hosting: exit 0. No dependency blockers; package.json and
package-lock.json are unmodified (git status clean apart from the three
intended files).

Tests: 839 pass / 0 fail (212 suites), including the new
pins the invalidation resource to the bundled SDK (no install at invoke).

Synth proof — DeployInvalidation fragment from a synthesized SSR stack:

"CdnDeployInvalidation5F20E44E": {
  "Type": "Custom::AWS",
  "Properties": {
    "ServiceToken": { "Fn::GetAtt": ["AWS679f53fac002430cb0da5b7982bd22872D164C4C", "Arn"] },
    "Create": { "Fn::Join": ["", [
      "{\"service\":\"CloudFront\",\"action\":\"createInvalidation\",\"parameters\":{\"DistributionId\":\"",
      { "Ref": "CdnHostingDistribution0C0AE0F7" },
      "\",\"InvalidationBatch\":{\"CallerReference\":\"blocks-test-ssr-1\",\"Paths\":{\"Quantity\":1,\"Items\":[\"/*\"]}}},\"physicalResourceId\":{\"id\":\"invalidation-test-ssr-1\"}}"
    ]]},
    "InstallLatestAwsSdk": false
  }
}

The CDK warning is also gone: synth reports 0 stack messages with the fix. That
check is not vacuous — reverting only the construct change reproduces exactly
one warning, installLatestAwsSdkNotSpecified at
/TestStack/Cdn/DeployInvalidation, and the fragment shows
"InstallLatestAwsSdk": true.

Non-vacuity of the test: with the construct change stashed, the suite is
838 pass / 1 fail, the single failure being the new assertion. With the change
applied it passes.

Checklist

• PR description included
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced) — no public API change, so no API.md update; rationale captured in a code comment and the changeset

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: a9f7b54

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@aws-blocks/hosting	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR