fix(lambda): load parameter store tags from an SSM path

[edersonbrilhante]

Summary

Terraform currently JSON-encodes the merged parameter_store_tags map and injects the complete payload into SSM_PARAMETER_STORE_TAGS for the scale-up and pool Lambdas.

AWS Lambda limits all environment variables associated with a function to 4 KB in aggregate. As the configured tag set grows, this JSON payload competes with the rest of the Lambda configuration and can cause function creation or updates to fail.

Store the JSON-encoded tag payload in SSM Parameter Store and expose only its parameter path to the Lambdas.

Proposed direction

• Keep the public parameter_store_tags map input unchanged.
• Create a module-managed parameter under the existing runner configuration path, for example ${ssm_config_path}/parameter_store_tags.
• Store the current { Key, Value }[] JSON representation in that parameter.
• Replace the inline JSON environment value with the parameter path through an explicit variable such as SSM_PARAMETER_STORE_TAGS_PATH.
• Have both the scale-up and pool Lambdas retrieve the value through the shared SSM utility and validate it with the existing tag validation.
• Keep access within the existing runner-config-path IAM scope; do not broaden the Lambda permissions.
• Preserve current empty-map behavior and the public Terraform contract.
• Explicitly handle the selected Parameter Store representation's value-size limit through validation, tier selection, or chunking so oversized tag payloads fail clearly rather than silently moving the limit.

Acceptance criteria

• The scale-up and pool Lambda environments no longer contain the JSON-encoded tag payload.
• Terraform creates an SSM parameter containing the merged parameter-store tags and exposes only its path to the Lambdas.
• Both Lambdas load, validate, and apply the same tags currently supplied through SSM_PARAMETER_STORE_TAGS.
• Empty tag maps continue to result in no tags being added to runtime-created parameters.
• Missing or malformed parameter values produce an actionable, tested error without logging the parameter value.
• Lambda IAM grants remain scoped to the exact parameter or existing runner configuration path.
• Stable and experimental/multi-runner configuration paths preserve the existing parameter_store_tags input behavior.
• EC2-created parameters and MicroVM metadata receive the same effective tags and merge precedence as before.
• The supported tag-payload size and behavior at the Parameter Store value-size boundary are documented and tested.
• Focused Terraform and TypeScript tests cover parameter creation, environment wiring, retrieval, validation, and tag application.
• Generated documentation is updated.

Related work

• Lambda environment paramaters can exceed 4KB limit #3594 and feat: migrate webhook runner configuration to SSM #3728 established the same pattern for moving RUNNER_CONFIG out of Lambda environment variables.
• Support for Custom Tags in AWS SSM Parameter Store #4833 and feat(control-plane): tag control plane created SSM Parameters (#4833) #4834 introduced the current custom Parameter Store tag support.
• SSM parameters can exceed 4K limit breaking terraform apply #3815 discusses Parameter Store's own value-size limit, which the implementation should account for explicitly.