fix(aws/lambda): type IAM and security-group propagation errors

[sam-goodwin]

Types the IAM and security-group propagation errors Lambda returns while a just-created role or security group isn't visible yet, so consumers retry on tags instead of matching messages.

lambda.createFunction(request).pipe(
  Effect.retry({
    while: (e) =>
      e._tag === "ExecutionRoleNotAssumable" ||
      e._tag === "ExecutionRoleMissingVpcPermissions" ||
      e._tag === "KmsGrantPrincipalNotReady" ||
      e._tag === "SecurityGroupNotFound",
    schedule,
    times: 10,
  }),
);

lambdacore.createNetworkConnector(request).pipe(
  Effect.retry({ while: (e) => e._tag === "OperatorRoleNotAssumable", schedule, times: 10 }),
);

• lambda: createFunction, updateFunctionCode, updateFunctionConfiguration get ExecutionRoleNotAssumable, ExecutionRoleMissingVpcPermissions, KmsGrantPrincipalNotReady (and SecurityGroupNotFound on create/configuration); create/updateEventSourceMapping get ExecutionRoleNotAssumable and ExecutionRoleMissingPermissions.
• lambda-core: create/updateNetworkConnector get OperatorRoleNotAssumable.

All are synthetic errors over InvalidParameterValueException with message matchers. Regenerating lambda also picks up the pinned mirror's model updates for that service.

🤖 Generated with Claude Code

[alchemy-version-bot]

Install the packages built from this commit:

@distilled.cloud

pnpm install https://pkg.distilled.cloud/@distilled.cloud/aws/pr:879:f4f2076

pnpm install https://pkg.distilled.cloud/@distilled.cloud/core/pr:879:f4f2076

Published Oct 15, 2026, 1:19 AM UTC. Expires Oct 22, 2026, 1:19 AM UTC, extended while this pull request is open.