Issue # (if applicable)

Closes #38404.

Reason for this change

Predefined Lambda runtimes expose untagged AWS SAM build images. Those images follow the latest published image, so their bundled tool versions can change independently of the AWS CDK version. Users whose builds require a specific tool version need clear guidance on selecting an explicit image tag.

Description of changes

• Document the untagged/latest behavior on Runtime.bundlingImage.
• Expand the Lambda README with an explicit Java 21 SAM build image tag example.
• Recommend choosing a compatible tag and updating pinned images regularly for tool and security updates.
• Link to the official AWS SAM build image repository documentation.

This is a documentation-only change. It does not pin CDK's predefined runtime images or change any runtime behavior.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Ran yarn build --fix in packages/aws-cdk-lib.
• Ran npx jest aws-lambda/test/runtime.test.ts --runInBand --coverage=false (7 tests passed).
• Ran strict Rosetta validation for the new README snippet.
• Ran git diff --check.
• Integration tests were not run because no executable or CloudFormation behavior changed.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license