Public Lambda function URLs now need two permissions

A Lambda function URL with auth NONE returns 403 Forbidden unless the resource policy has both lambda:InvokeFunctionUrl (FunctionUrlAuthType NONE) and lambda:InvokeFunction with condition lambda:InvokedViaFunctionUrl=true. Older AWS CLI v2 builds (e.g. 2.17) lack the --invoked-via-function-url flag, so scripts that suppress errors silently skip it; boto3 AddPermission with InvokedViaFunctionUrl=True works. Also, when serving a Next.js standalone server via Lambda Web Adapter, point AWS_LWA_READINESS_CHECK_PATH at a route that does not depend on a backend, or a backend outage blocks cold starts.