python: add a link_python field for FaaS venv artifacts

[jasonwbarnett]

Pex 2.103.0 added pex3 venv create --link-python (pex-tool/pex#3279), which points the created venv's Python at a given path instead of the interpreter that laid the venv out. That path need not exist yet, so a local interpreter can lay out a venv for the foreign platform the artifact will actually run on.

This plumbs the flag through PexVenvRequest and exposes it as a link_python field on the AWS Lambda and Google Cloud Function targets, so layout="venv" works for a cloud runtime — e.g. link_python="/var/lang/bin/python3.13". It also upgrades the default Pex to v2.103.1; the minimum is unchanged.

Verification details are in a comment below.

LLM assistance: the code, tests and release note here were written by Claude Code (Opus 5).

🤖 Generated with Claude Code

[jasonwbarnett]

Verification

• pants test on util_rules/faas_test.py and the AWS Lambda / GCF rules_test.py — green.
• pants run src/python/pants_release/generate_github_workflows.py -- --check — green, after regenerating the workflow Pex pins.
• pants fmt lint check on the touched files — green.
• The new pex_venv_test.py case was exercised locally against a pure-Python requirement, since the shared local_pex fixture's psycopg2-binary==2.9.12 has no cp314t wheels and so cannot resolve on this machine. It confirms end to end that the venv's bin/python* links point at the (non-existent) --link-python path, that pyvenv.cfg's home follows, and — the part that wasn't obvious up front — that the engine captures and materializes the deliberately dangling symlinks without error.

Notes for review

• [pex-cli].version_constraints keeps its >=2.100.5 minimum, so setting link_python while pinning an older Pex surfaces as an unrecognized arguments: --link-python subprocess failure. Happy to raise the minimum instead.
• Pex ignores --link-python for the flat and flat-zipped layouts, so the field's help says it has no effect there rather than the field being validated against layout. Easy to make that an InvalidTargetException if you'd prefer it loud.

[jsirois]

It also upgrades the default Pex to v2.103.1; the minimum is unchanged.

If you added code that needs a new flag - then the minimum version required is the version that starts providing that flag. Otherwise, you just added an exception for someone who has a custom [pex-cli] setup that's >= the current min but <2.103.1. ... Ok - you acknowledge this even above ... I have no clue why you think that's OK!

Claude really sucks for this sort of thing still.

Every time a human who is not you corrects Claude's work on your behalf - you should wince.
Please self-review Claude hard before you plop its results out for humans to have to deal with.

[jasonwbarnett]

I knew this, I mostly didn't know what pants' policy/standards where around it which I should have called out!