fix(s3-deployment): preserve file integrity when no markers are present

[ozelalisen]

Issue # (if applicable)

Closes #35050.

Reason for this change

AWS CDK S3 deployment was causing MD5 hash mismatches between local files and deployed files, even when no markers were present for replacement. This broke integrity validation for customers relying on MD5 checksums to verify file content hasn't been tampered with during deployment.

Description of changes

Core Fix:
• Modified replace_markers() function to track whether any actual marker replacements occur during line-by-line processing
• Only replace the original file if changes were made; otherwise preserve the original file untouched
• This maintains the performance benefits of line-by-line processing from PR #34020 while fixing the file integrity issue

Key Changes:
• Added replacements_made boolean tracking in the marker replacement loop
• Compare each line before and after replacement to detect actual changes
• Conditional file replacement: only overwrite original if modifications occurred
• Remove temporary file and keep original when no changes are made

Describe any new or updated permissions being added

No new or updated IAM permissions are required. This is a bug fix that only modifies the internal file processing logic without changing any AWS API calls or resource access patterns.

Description of how you validated changes

• Added unit tests
• Verified core functionality with Issue Reproduction Steps on Issue #35050.
• Confirmed MD5 hash preservation

Checklist

• [x] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 78c98d8
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[Abogical]

I don't think the unit test (at packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/test.py) are correct. They seem to pass even before any changes to packages/@aws-cdk/custom-resource-handlers/lib/aws-s3-deployment/bucket-deployment-handler/index.py are made. Try the following:

$ git checkout main -- packages/@aws-cdk/custom-resource-handlers/lib/aws-s3-deployment/bucket-deployment-handler/index.py
$ ./packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/test.sh
# ^ This should fail but it doesn't.

[Abogical]

The original issue probably isn't a regression. This PR may not be needed. Adding a do-not-merge label.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.