ci: verify examples in CI and note Lambda Version ARN resolvable

Add a `Verify examples` step to the checks job, right after
`Verify schema`, so `make verify-examples` runs on every PR and catches
Resolvable shape regressions in the example formae. Also record the new
`AWS::Lambda::Version` functionArn resolvable in the changelog.

Author: clanker-pel[bot]

.github/workflows/ci.yml

@@ -59,6 +59,9 @@ jobs:
       - name: Verify schema
         run: make verify-schema
 
+      - name: Verify examples
+        run: make verify-examples
+
   # Integration tests run against real AWS resources (Route53, EC2, etc.)
   # These are self-contained: each test creates and cleans up its own resources.
   test-integration:

CHANGELOG.md

@@ -39,6 +39,19 @@ formae agent.
   configuration on the first update — so the resource is **not discoverable**
   in this version. Discovery can be enabled once the full property surface is
   modelled.
+- `AWS::Lambda::Version` now exposes a `res.functionArn` resolvable carrying
+  its qualified (versioned) function ARN, so a CloudFront distribution's
+  `lambdaFunctionAssociations` entry can reference a published version by
+  reference instead of a hand-edited literal ARN pin. Lambda@Edge rejects
+  `$LATEST`, so the association has always needed a versioned ARN; previously
+  that ARN had to be copied in by hand. Note the caveat this doesn't remove:
+  every field on `Version` is create-only, so a function code change publishes
+  a *replacement* version rather than updating the existing one. The safe
+  order is publish the new version, re-point the distribution at it, wait for
+  CloudFront to propagate the change, and only then delete the old version,
+  and a replicated Lambda@Edge version can stay undeletable for a while after
+  the association is removed. Exposing the resolvable removes the hand-edit;
+  it does not change that ordering.
 
 ### Changed