feat(ecs): make the ECS Fargate compute backend usable (context-gated wiring + ECS-parity fixes)

[isadeks]

Summary

Governing issue for the ECS substrate hardening work in PR #596 (Stack A: #503 → #596 → #597 → #598). Filed to close the ADR-003 loop — #596's branch (pr/ecs-substrate-hardening) referenced the merged PR #494 rather than an open approved issue.

The ECS Fargate compute backend exists in the tree but isn't usable end-to-end: it needs the compute_type=ecs deploy gate wired, ECS-parity IAM grants (the AgentCore runtime role has them; the ECS task role didn't), and the payload/boot path fixed so nothing is silently dropped.

Prior art / siblings: #494 (merged — "two bugs that prevent ECS Fargate from working"), #502 (approved — the 8 KB containerOverrides → S3 pointer, fixed by #503).

Scope / acceptance criteria

• ECS resources synthesize only under --context compute_type=ecs; the default (agentcore) synth stays byte-for-byte unchanged.
• run_task_from_payload binds to run_task's real signature (inspect.signature) so no orchestrator field is silently dropped (ABCA-487 class); a dropped known orchestrator key is logged.
• ECS-parity IAM grants present + least-privilege + individually tested: AgentCore Memory CreateEvent (scoped to the memory ARN), bgagent-*-oauth-* GetSecretValue, ec2:DescribeAvailabilityZones (synth AZ lookup), read-only payload bucket.
• CLI onboarding reads the ComputeSubstrate output and fails at config-time (not per-task) when a repo is set to compute_type: ecs on an agentcore-only stack.
• Bootstrap (ADR-002) coverage verified — no AccessDenied gap when deploying with the ECS gate on.

Notes

Implementation is up in #596 (approved-pending; nits N1–N4 addressed). Requesting the approved label + branch rename to feat/<this-issue>-… before merge, per ADR-003.