ci: exclude conflict-affected regions

[zhongkechen]

Summary

• temporarily exclude me-central-1 and me-south-1 from default layer publishing while AWS reports conflict-related service disruption
• continue publishing to every other commercial Region, including opt-in Regions
• retain the workflow input and environment variable overrides for explicitly targeting excluded Regions after recovery
• update release documentation for the universal layer and temporary Region policy
• add a test that locks the default Region set to all commercial Regions except the two conflict-affected Regions

Testing

• hatch run test:all .github/scripts/tests/test_lambda_layer_publish_workflow.py .github/scripts/tests/test_build_lambda_layer.py .github/scripts/tests/test_parse_sdk_branch.py .github/scripts/tests/test_resolve_layer_sdk_version.py
• hatch fmt --check .github/scripts/tests/test_lambda_layer_publish_workflow.py
• parsed both modified workflow YAML files

[github-actions]

Codex AI review

No actionable findings. Residual risk is limited to live GitHub Actions and AWS publishing behavior, which the static configuration test does not exercise.

Reviewed commit 3fca3b1730959abf179c7baeead393deb84ddc79. Workflow run

[github-actions]

Claude AI review

This PR is a CI/docs-only change that temporarily excludes me-central-1 and me-south-1 from DEFAULT_LAYER_REGIONS in .github/workflows/lambda-layer-publish.yml, adds a lock test (test_lambda_layer_publish_workflow.py), wires that test into test-parser.yml (adding PyYAML==6.0.2 and a trigger path for the workflow file), and updates RELEASING.md. It does not touch the SDK runtime, so the checkpoint/replay, serialization, async, and public-API focus areas do not apply.

Verification performed

• The new test passes: the workflow's >- folded scalar yields a comma+space-joined string, which the test splits on , and strips; the recovered 32-region set exactly equals COMMERCIAL_REGIONS - CONFLICT_AFFECTED_REGIONS. The test's COMMERCIAL_REGIONS (34 entries) matches the base workflow list exactly, and both drop the same two regions.
• Path(__file__).parents[2] / "workflows" / "lambda-layer-publish.yml" correctly resolves to the workflow under .github/.
• PyYAML==6.0.2 is available both in the test-parser.yml job and the root hatch test env, so the test runs under either invocation. The test accesses workflow["env"], avoiding the YAML on:→True boolean gotcha.
• RELEASING.md wording (region exclusion, universal single-layer artifact) is consistent with the actual workflow behavior.

No actionable findings.

Residual test risk (by design, not a defect): the lock test hardcodes the full commercial-region set, so any future region added to the workflow must also be added to COMMERCIAL_REGIONS or the test fails — this is intentional to force a conscious update. Also note the new test executes only via test-parser.yml; it is not under the root pyproject.toml testpaths, so hatch run test:all (with no explicit path) will not collect it.

Reviewed commit 3fca3b1730959abf179c7baeead393deb84ddc79. Workflow run