fix: avoid vendoring adot layer dependencies

[zhongkechen]

Summary

• install only the SDK and OTel plugin wheels in the published layer
• rely on the Lambda runtime and ADOT layer for runtime dependencies
• publish one universal layer version per region for Python 3.11-3.14 and both architectures
• reject non-universal wheels and test that ADOT/OpenTelemetry dependencies are excluded

Root cause

The layer builder resolved the plugin dependencies into /opt/python, overriding OpenTelemetry packages supplied by ADOT. The mixed versions prevented ADOT initialization and X-Ray trace export.

Testing

• hatch run test:all .github/scripts/tests/test_build_lambda_layer.py .github/scripts/tests/test_parse_sdk_branch.py .github/scripts/tests/test_resolve_layer_sdk_version.py
• hatch fmt --check .github/scripts/build_lambda_layer.py .github/scripts/tests/test_build_lambda_layer.py
• built the real SDK and plugin wheels and inspected the resulting universal layer ZIP
• parsed the updated workflow YAML and verified both jobs have no matrix

[github-actions]

Codex AI review

No actionable findings. Residual risk: no committed cloud integration test exercises the universal layer with ADOT across all advertised runtimes and architectures.

Reviewed commit bf19bcc9af084d711f9acf7c906866339e7a699d. Workflow run

[github-actions]

Claude AI review

No blocking findings. The change is coherent and the tests directly cover the fix.

What the PR does

• build_lambda_layer.py drops platform/ABI targeting and adds --no-deps, so the layer installs only the SDK + OTel plugin universal wheels; it now rejects non-universal (-py3-none-any.whl) wheels.
• lambda-layer-publish.yml removes the per-runtime/architecture matrices from both build-layer and publish-layer, builds one artifact, and publishes it as universal (--compatible-runtimes python3.11 python3.12 python3.13 python3.14 --compatible-architectures x86_64 arm64). All ${{ matrix.* }} references in these jobs were removed with no dangling ones left, and the sha256-based idempotent reuse logic stays valid for the single layer.
• Tests are updated in step; test_build_layer_excludes_adot_and_runtime_dependencies hermetically (PIP_NO_INDEX/PIP_FIND_LINKS) proves boto3, ADOT (amazon/), and opentelemetry/ are not vendored, guarding the root cause, and test_build_layer_requires_universal_wheels covers the new validation.

Residual risks (not defects in the diff; flagged for awareness)

• Runtime dependency provisioning: the layer no longer vendors boto3 (SDK pins boto3>=1.42.1 for the durable-execution Lambda APIs like checkpoint_durable_execution) or the OpenTelemetry packages. Correctness now depends on the Lambda runtime bundling a boto3 new enough to expose the durable-execution operations, and on the ADOT layer providing opentelemetry-sdk/opentelemetry-exporter-otlp/opentelemetry-propagator-aws-xray (needed by the ExecutionOtelPlugin/auto-configured provider paths). These are AWS-environment facts I cannot verify from the repo; worth an e2e deploy check against a target runtime before release.
• Docs drift: RELEASING.md (unchanged, so not commented inline) still describes building "for each supported Python runtime and architecture" and "Each runtime and architecture layer archive is built once" — now stale given the single universal layer. Consider updating it in this PR.

Reviewed commit 7a1173f6bfc0f0156efde02db8a67bfb71e8cfdf. Workflow run