refactor(runner-providers): isolate EC2 provider handling

[edersonbrilhante]

Description

Moves dynamic-label provider selection out of the webhook Lambda and into the runner-provider package so Lambda orchestration depends only on a generic provider boundary.

• Moves selector ownership and routing tests into libs/runner-providers.
• Makes webhook dispatch tests mock the generic selector instead of exercising EC2 policy behavior.
• Moves EC2 dynamic-label behavior coverage into the EC2 provider tests.
• Extracts reusable AWS dynamic-label policy evaluation while preserving the EC2 policy interface.
• Uses a stable fake provider name in unsupported-provider tests.
• Removes the unused webhook policy type facade.

This is stacked on #5251 and prepares the provider boundary for additional runner implementations without adding a new provider.

Test Plan

• Runner-provider suite: 48 files and 794 tests passed.
• Webhook dispatch suite: 16 tests passed.
• Focused control-plane suites: 125 tests passed.
• ESLint passed for the modified provider and Lambda files.
• Production TypeScript check passed.
• Webhook and control-plane Lambda builds passed.

Related Issues

Depends on #5251.

Related to #5252.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None