…ed lambdas

Custom-resource handler Lambdas generated by the handler framework previously
staged their code via `lambda.Code.fromAsset(path)` with no explicit asset hash,
so `AssetStaging` fingerprinted the bundled directory at synth time. Because
that fingerprint depends on filesystem metadata (mtime, mode), the resulting
S3 object key differed between machines even when the bundled bytes were
identical — causing `cdk diff` to show spurious Lambda asset updates when
comparing a local synth to what was previously uploaded to S3.

Compute a content-only SHA-256 of each bundled handler directory at generation
time (in `scripts/generate.ts`) and bake it into the generated framework class
as `Code.fromAsset(path, { assetHash })`. The value depends only on file
names and bytes, so the S3 object key is now stable across machines.

The new `sourceHash` option on `HandlerFrameworkClassProps` is optional and
only emitted for `FUNCTION` and `SINGLETON_FUNCTION` components.
`CUSTOM_RESOURCE_PROVIDER` components are left untouched because
`CustomResourceProviderBase` mixes `__entrypoint__.js` into the staged
directory at synth time, so a hash pinned at generate time would drift from
the final bundle.

Closes aws#34307

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The deterministic asset hashes emitted by the generated custom-resource
handler classes produce new S3 object keys, so every integ snapshot that
exercises an affected handler needs its asset directory renamed and its
JSON manifests rewritten to reference the new hash.

Updated by renaming the asset directories and replacing the old hash
with the new hash in the snapshot JSON files. No other snapshot content
is changed.

…s-framework/classes.ts

Co-authored-by: Otavio Macedo <288203+otaviomacedo@users.noreply.github.com>

…generation

Pass the source hash through expr.lit so expr.object receives an
Expression instead of a raw string, and apply the same expr.object form
to the SingletonFunction call site for consistency. Update the two
framework tests to match the multi-line rendering that expr.object
produces.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… snapshots

Security Guardian flagged pre-existing findings in integ snapshots that
this PR's deterministic-asset-hash change brought into scope (the asset
hash field changed, so Security Guardian re-scanned the templates).

Fixes the three findings that are addressable in test code:

- aws-events-targets integ.log-group: enable SQS-managed encryption on
  the integ test's DLQ.
- aws-logs-destinations integ.lambda: enable SQS-managed encryption on
  the integ test's destination queue.
- custom-resources integ.aws-custom-resource: replace ssm:* with the
  specific actions the test exercises (GetParameter, GetParameters,
  GetParametersByPath, DescribeParameters).

The four remaining Security Guardian findings come from CDK framework
defaults (DynamoDB replication policy, ALB internet-facing ingress,
CodePipeline cross-account action role trust) and are pre-existing on
main. Addressing them requires feature-flagged framework changes and
belongs in separate PRs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…sset-hashes