Added Lambda-runtime-upgrade-skill - #22

…le skill (#23)

Lambda runtime upgrade reports now do their deterministic work in Python instead of asking the model to orchestrate it. A new one-shot generate_upgrade_analysis tool discovers regions, scans them in parallel for deprecated and end-of-life runtimes, downloads and statically scans code for the critical ones, and returns a rendered analysis; the agent only adds narrative and playbook on top of that.

The report template collapses from two sections to a single full_upgrade_report section, so there is no longer a second dependent section that has to re-run heavy multi-region work after the first one finishes. Reports now generate to completion in about thirty seconds.

The sweep is live rather than cached, and bounded rather than open-ended. Regions are scanned across ten workers, per-function config and code analysis across fifteen, and last-invoked enrichment is batched into a single CloudWatch GetMetricData call of up to five hundred queries per region rather than one call per function. Code download is capped at seventy-five end-of-life functions by default (raiseable to one hundred and fifty), with functions beyond the cap getting family-generic recommendations instead of per-function findings, and extraction is size-capped. Runtime deprecation dates come from a static table in the handler, since Lambda exposes no API for them. Everything stays read-only; the tool makes no mutating AWS calls.

Also adds a portable lambda-runtime-upgrade skill with a runtime-migration knowledge base, so the same guidance is usable outside the deployed agent. This supersedes #22, whose two skill files are identical to the ones added here.

IAM grows by exactly one explicit action, cloudwatch:GetMetricData, for the new enrichment. No wildcards.

Testing: 815 unit tests pass. Verified on a deployed stack: the new tool registered on the gateway with its target READY, end-to-end routing from supervisor through ops-excellence to the lambda-upgrade agent returning live data, a full report generated to completion with real content, single-function queries answering correctly, and no tool-Lambda errors.