feat(aws): export the MicroVM service limits MicrovmApp enforces

[lex00]

Closes #1374.

MicrovmApp encodes the Lambda MicroVMs service's real limits — five memory tiers, name pattern and length, environment-variable cap, connector bounds — verified against the upstream CDK construct and the AWS docs. All module-private, so a consumer driving the same service through a different control plane had to copy them.

kubemicrovm-ops does exactly that: its tier profile declares the five memory sizes a second time and its lint pack a third, while its own design page names this composite as the source of truth for two planned rules it cannot import.

One named object rather than seven loose constants:

export const MICROVM_LIMITS = {
  memoryMiB: [512, 1024, 2048, 4096, 8192],
  namePattern: /^[a-zA-Z0-9-_]+$/,
  maxNameLength: 64,
  reservedEnvironmentKeys: ["AWS_REGION"],
  maxEnvironmentVariables: 50,
  maxEgressConnectors: 10,
  connectorSubnets: { min: 1, max: 16 },
} as const;

The composite reads its own validation out of it, which is what keeps the export honest. The test probes the limits through MicrovmApp's public API rather than restating them, so an export and an enforcement cannot drift apart while both look right.

Reachable from the package root, guarded by the barrel test from #1337.

Worth a follow-up: whether other composites hold service limits the same way. This is unlikely to be the only one, and the general shape — a composite knowing something real that nothing else can reach — is the thing.