[proton0210]

Which issue(s) does this change fix?

Closes #9283.

Why is this change necessary?

Local AWS::Serverless::MicrovmImage.CodeUri paths are currently left unchanged by packaging. Moving the template during sam build also leaves relative paths pointing at the wrong directory.

How does it address the issue?

• Register MicrovmImage.CodeUri as a local artifact and add a ZIP exporter using the existing S3 uploader/content hash. Directories are zipped; existing ZIPs are uploaded unchanged. S3 URIs and intrinsic references remain unchanged.
• Reuse the existing template-relocation path for default/custom build directories, nested stacks, and ZIP artifact detection used by deployment packaging.
• Do not upload the template directory when the required CodeUri is missing.

MicroVM Dockerfiles are built by the service, not Lambda runtime builders. sam build preserves a reference to the original context, which must remain available until packaging. No new .samignore/.dockerignore behavior is introduced. This is separate from WebFunction PR #9340.

What side effects does this change have?

MicroVM code is recognized by the shared artifact detection/relocation/cleanup machinery, including existing sam delete retention behavior. No dependencies, IAM/bucket policies, or service-side image build behavior change. Usage and limitations are documented in docs/microvm-image-packaging.md.

Testing

Three audit passes covered scope/build semantics, packaging safety/compatibility, and final regression/static checks.

• make pr passed: schema generation, repository-wide Black/Ruff/mypy, 9,440 unit tests, 25 skipped, 31 subtests; 94.15% coverage.
• 11 functional tests passed with real archive/hash/uploader code and mocked S3 I/O: relative/absolute directories, unchanged/changed content keys, existing ZIPs, remote/intrinsic/missing paths, built-template relocation, and nested stacks.
• 2 CLI build integration tests passed, default and custom output directories, without AWS credentials or Docker.
• Three upload/relocation regressions fail on unchanged upstream 778292f and pass with this change.
• Added a live packaging case to the existing credential-gated S3 integration suite; collected successfully, not run locally. No AWS upload/deployment was performed. Local verification used Python 3.12.3.

Mandatory Checklist

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods (no new production methods)
• Write design document if needed (not required: existing exporter registration, no new command/design)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed (no dependency changes)
• Write documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.