KubectlProvider service role missing lambda:GetFunction permission when using BackstageAddOn

**Describe the bug**
When deploying an EKS Blueprints-based stack that includes the `BackstageAddOn`, the deployment fails with a `CREATE_FAILED` error on a `Custom::AWSCDK-EKS-KubernetesResource`. The failure is due to a missing `lambda:GetFunction` permission on the custom resource's service role created by the `KubectlProvider`. This role is defined inside a nested stack and is not directly modifiable via CDK Aspects or standard patching methods.

**To Reproduce**
Steps to reproduce the behavior:

1. Follow blog post instructions to create backstage cdk project https://aws.amazon.com/blogs/opensource/building-developer-portals-with-backstage-and-amazon-eks-blueprints/
2. Deploy the stack using `make make pattern backstage synth`.
3. Wait for the EKS cluster to be created and for Backstage to begin deploying.
4. Observe the deployment failure on the `AwsAuth` or similar Kubernetes resource, with a message like:

```yaml
Received response status [FAILED] from custom resource. Message returned: TimeoutError: {"state":"TIMEOUT","observedResponses":{"403: User: ... is not authorized to perform: lambda:GetFunction on resource: ... because no identity-based policy allows the lambda:GetFunction action"},"reason":"Waiter has timed out"}
```

**Expected behavior**
The cluster deploys

**Screenshots**
https://imgur.com/SHBf2ZV

**Desktop (please complete the following information):**
- OS: Mac
- node version v24.4.0
- cdk version 2.1019.0 (build e9c24a6)

**Additional context**
The failing IAM role (`ProviderframeworkonEventServiceRole`) is defined inside the nested stack `backstageblueprintawscdkawseksKubectlProviderE93845D8`, which is generated by `aws-cdk-lib/aws-eks`'s internal `KubectlProvider`. Just need to add this to the policy:

```ts
role.addToPolicy(
new iam.PolicyStatement({
actions: ['lambda:GetFunction'],
resources: ['*'],
}),
);
```
Requesting one of the following:

Add lambda:GetFunction to the default permissions in the KubectlProvider role

Or provide a clean escape hatch in EKS Blueprints to patch/customize this role

Start by reproducing the Backstage deployment with `make make pattern backstage synth` and inspect the generated nested stack containing the KubectlProvider role. Trace how `ProviderframeworkonEventServiceRole` is created and determine whether adding `lambda:GetFunction` or providing an EKS Blueprints escape hatch makes the cluster deployment complete successfully.

Written by the indexing model from the issue text.