fix(studio): avoid IAM policy writes during self-update

[evanlowe]

Summary

• stop Studio self-update provisioning from creating or updating the managed IAM policy
• remove iam:CreatePolicy and iam:UpdatePolicy from the Function runtime policy while retaining vefaas:GetApplicationRevisionLog
• continue updates when release logs are unreadable and link administrators to the provider-specific IAM console
• skip the post-release log settle delay when log access is unavailable

Verification

• uv run pre-commit run --show-diff-on-failure --color=never --all-files
• uv run pytest -n 16 (2050 passed, 6 skipped)
• npm test (652 passed)
• deployed and exercised Studio self-update on Volcengine and BytePlus
• verified both runtime policies include vefaas:GetApplicationRevisionLog and exclude the two IAM policy write actions