fix(aws): destroy converges in one pass with VPC-attached Lambdas

[sam-goodwin]

Fixes the destroy failure reported with https://github.com/xofromthemoon/alchemy-aws-demo — destroying a stack with a VPC-attached Lambda failed with subnets/security groups stuck on DependencyViolation (Waiting for dependencies to clear... (attempt 17)), forcing users to run destroy multiple times.

Root cause: DeleteFunction returns immediately, but the function's Hyperplane ENIs stay in-use in their subnets/security group for minutes and AWS's own reaper can take 20+ minutes to delete them after they detach (reproduced live: ENIs detached ~4 min after function delete and were still undeleted 12+ min later). The Subnet retry budget (~12 min) and SecurityGroup budget (~2.5 min) both expired first, failing the destroy even though deletion ordering was correct.

• EC2/LingeringEnis.ts: shared retryWhileLingeringEnis — on every DependencyViolation, observe the ENIs still occupying the subnet/SG and explicitly delete detached Lambda ENIs instead of waiting for Lambda's reaper. While the blockers are Lambda ENIs (guaranteed to clear), the retry budget extends from ~12 min to ~25 min; other dependencies keep the base budget.

  // detached Hyperplane ENIs flip InterfaceType "lambda" -> "interface";
  // only the description still identifies them (same matching as Terraform)
  const isReapableEni = (eni) =>
    eni.InterfaceType === "lambda" ||
    eni.Description?.startsWith("AWS Lambda VPC ENI");

• EC2/Subnet.ts, EC2/SecurityGroup.ts: delete paths now retry through the reaper (SecurityGroup's budget was previously only 30×5s).

• Lambda/Function.ts: precreate no longer forwards news.vpc into CreateFunction — precreate props are unresolved, so an Output-valued subnet id crashed serialization (ParseError: Expected string, got PrivateSubnet1.subnetId). The stub is created without a VPC config; reconcile attaches the resolved config as before.

• test/AWS/Lambda/VpcFunctionDestroy.test.ts: live regression test (FAST-gated) — deploys Network + SG + VPC-attached function, asserts one destroy removes everything including the VPC. Failed before the fix with the exact symptoms from the report; passes in a single pass with it.

[alchemy-version-bot]

Install the packages built from this commit:

alchemy

bun add alchemy@https://pkg.ing/alchemy/2c75115

@alchemy.run/better-auth

bun add @alchemy.run/better-auth@https://pkg.ing/@alchemy.run/better-auth/2c75115

@alchemy.run/pr-package

bun add @alchemy.run/pr-package@https://pkg.ing/@alchemy.run/pr-package/2c75115