feat: add production ECS release path

[suguanYang]

Summary

• add a release-gated production Aurora migration job before either EKS rollback or ECS deployment
• add production ECS task-definition rendering and service rollout for API on-demand Fargate and worker Fargate Spot
• require release tags to point to main
• parameterize the existing staging task-definition templates without changing the accepted staging topology
• document the production IAM, Secrets Manager, CloudWatch, ECS, and ALB prerequisites

Production decisions

• production worker task size: 2 vCPU / 4 GiB
• WORKER_CONCURRENCY=10
• production API: 0.25 vCPU / 1 GiB, DB pool 50 + overflow 50
• release source: a published semantic release whose tag points to main

Validation

• git diff --check
• uv run pytest deploy/ecs/test_render_task_definitions.py
• uv run ruff check deploy/ecs
• JSON validation for both task-definition templates
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/build-images.yml

This PR does not create or modify AWS resources. The release path intentionally fails until the separately approved production IAM roles, runtime secret, log groups, ECS services, and API ALB target/rule exist.