fix(layers): bundle all publishable utilities in the Lambda layer

[svozza]

Summary

The Lambda layer bundled a hardcoded list of 10 packages, silently omitting the
published data-masking, signer, kafka, and validation utilities.
Customers relying on the layer alone hit module-not-found errors for those
features. This derives the bundled list from the workspace so the four missing
utilities are included and any future utility is bundled automatically, without
the list drifting out of sync.

Changes

• layers/src/layer-publisher-stack.ts: replace the hardcoded utilities array with getLayerUtilities(), which scans packages/*/package.json and keeps every non-private @aws-lambda-powertools/* package; both the published-install and buildFromLocal paths now key off the derived package name / workspace dir. Adds packTarballPrefix() and an empty-list guard.
• layers/tests/e2e/layerPublisher.class.test.functionCode.ts: import and exercise the four newly-bundled utilities (DataMasking.erase, validate, kafkaConsumer, SigV4Signer) so the E2E proves they load from the layer; read the layer's @aws-lambda-powertools/ directory for the version-parity check instead of a hardcoded list.
• layers/tests/unit/layer-publisher.test.ts: assert the locally-bundled layer contains every derived utility and excludes the private testing-utils.
• layers/tests/unit/getLayerUtilities.test.ts (new): pure tests for the helpers, including asserting the real workspace resolves to exactly the 14 public packages.

Testing

• Unit + pure-function tests pass; biome ci and tsc --noEmit clean.
• Local bundle inspection: all 14 packages, 24 MB; no @aws-sdk/* client shipped (only the types-only @aws-sdk/types), preserving the fix(layers): do not ship AWS SDK clients in the Lambda layer #5512 invariant; @aws-crypto/client-node correctly absent (optional peer).
• Real E2E against a sandbox account (eu-west-1): layers/tests/e2e/layerPublisher.test.ts 8/8 passed — published a live layer, deployed and invoked CJS and ESM functions on it exercising all four new utilities, then auto-torn-down with no leftover stacks.
• Not covered locally (handled by the release pipeline): production multi-region publish and SSM/ARN wiring.

Issue number: closes #5576

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.