Fix Node bootstrap launcher metadata and request normalization

[denusklo]

Summary

Fixes #650.

• Use NodejsLambda with handler: 'launcher.js' and awsLambdaHandler: 'launcher.launcher'. Keep the existing named CommonJS export and disable helper/source-map injection.
• Fall back to /var/task when LAMBDA_TASK_ROOT is absent, without injecting that reserved deployment environment variable.
• Normalize legacy Invoke and direct event bodies: preserve Buffers, validate byte arrays, decode base64/UTF-8 strings, and handle empty/null/missing bodies.
• Add case-insensitive host-header fallback and checked request/body boundary types.

The generic Lambda constructor drops the extra launcher metadata. The existing build-utils dependency already exports NodejsLambda.

Live Vercel validation

Deployed runtime commit 20514de4e85e22a3e1ffc21e2738e1fa298e3043 to a new isolated project using CLI 62.2.0, Linux prebuilt output, Node.js 22.x and bundled PHP 8.5.2.

Preview: https://php-pr654-smoke-20261003-35x999dxl-denusklos-projects.vercel.app

The Preview retains Vercel Authentication protection. No existing application, production environment or application secrets were used. vercel curl provided authenticated access.

10/10 live checks passed: GET/query preservation, subsequent GET, form POST, UTF-8 JSON POST, binary POST, multipart upload/hash, multiple response cookies and cookie return, a two-request PHP session round trip, exact binary response bytes with HTTP201, and HTTP418 status propagation. The session observation is limited to those sequential requests, not a claim of cross-instance persistence.

The collected Preview request logs contain 25 requests: 21 HTTP200, two HTTP201 and two intentional HTTP418 responses. No 5xx responses or matching invocation/module/export/startup failure markers appeared in that captured window.

The local builder cache was linked to the checked-out PR. Its generated filePathMap referenced files outside the fixture upload directory, so the initial upload failed before invocation. For the successful deployment, all 107 referenced files were copied byte-for-byte into the function directory with SHA256/mode checks and only the filePathMap optimization was removed. Handler/runtime/environment metadata and runtime source were unchanged. This validates the deployed runtime fix, not a new npm release or every CLI source-upload configuration.

An initial UTF-8 JSON check passed text through Windows curl argv and sent a single-byte é. A standalone loopback curl probe reproduced that client encoding issue without Vercel. The final JSON check sends an explicit UTF-8 file and verifies exact received bytes.

Other verification

• TypeScript build and focused tests pass on Windows x64, Ubuntu WSL2 x64 and macOS arm64.
• Genuine offline vercel build passes on Linux with CLI50.4.5 and CLI62.2.0, including output metadata, mapped files and executable modes.
• Local real-PHP HTTP smoke passes on Linux/macOS. Windows port3000 is occupied, so that smoke was not run there; no existing service was stopped.
• Full Jest/file collection passes on Linux/macOS. This independent branch retains Windows packaging/path failures addressed by Fix Windows runtime bundle paths #652.
• Bounded request/response property checks pass on Windows/Linux.

Coverage is Node22/PHP8.5.2 on this deployment. Other Node/PHP versions, regions and full application frameworks are not established by this smoke. Feedback from affected #650 reporters is welcome. When integrating #652, the overlapping CGI and bundle-key test expectations need reconciliation; this PR intentionally does not include the Windows packaging fix.

[denusklo]

Live validation is now complete for commit 20514de on a protected Vercel Preview, Node22 / PHP8.5.2:

• 10/10 checks passed: GET/query, warm GET, form/UTF-8 JSON/binary POST, multipart upload, cookies, sequential session round trip, binary response and status propagation.
• Captured Preview logs: 25 requests, no 5xx and no matching module/export/invocation/startup failure markers.
• Actual CLI62.2.0 build/deploy, with the generated external file-map references materialized byte-for-byte into a self-contained function. No runtime-source or handler-metadata patch was applied after building.

The PR description now records the deployment URL, packaging detail and coverage limits. I'm marking this ready for review; the issue is not closed until the fix is accepted. An affected application's confirmation would still be useful.