ECR tag immutability: deploys reference the image by digest, :latest retires, then IMMUTABLE flips (tf-lint AVD-AWS-0031) #224

Item 1 of #180, accepted 2026-10-30. The pipeline half is lentago/shared-workflows#85; the Terraform half and the final flip are here.

Why :latest is load-bearing today

site-deploy.yml builds and pushes two tags (:latest and :<sha>), attests the digest, then runs aws ecs update-service --force-new-deployment. The task definitions in modules/ecs and modules/site reference ${repository_url}:${container_image_tag} with the default latest, so a forced deployment re-pulls :latest. That is exactly what IMMUTABLE forbids, and it is one source of the standing task-definition replacement dirt in #184.

Order of operations (each step deployable on its own)

1. shared-workflows (site-deploy: register a digest-pinned task-definition revision per deploy and stop pushing :latest shared-workflows#85): the deploy registers a new task-definition revision whose image is the digest-pinned reference the attestation step already resolves (<registry>/<repo>@sha256:…), updates the service to that revision, and stops pushing :latest. The :<sha> tag stays as the human-readable handle. The deploy role may need iam:PassRole on the task and execution roles to register a revision; if so the grant lands here.
2. Here: the task definitions stop asserting the image. Terraform owns the task definition's shape (CPU, memory, log config, firelens) and ignores the container image, so deploy-owned attributes stop fighting the plan. This closes the task-definition half of CI plans are never clean: standing task-definition replacements and a recreating SNS email subscription #184 as a side effect; say so in the PR.
3. Here, last: image_tag_mutability → IMMUTABLE in modules/ecr and modules/site, and the trivy:ignore:AVD-AWS-0031 lines come out. Only after step 1 is released and all three site repos have bumped their caller tag.

Acceptance

• Three site deploys green with no :latest tag written; aws ecr describe-images shows only sha tags for new pushes.
• A docs-only PR's plan no longer lists the task definitions.
• tf-lint passes with the AVD-AWS-0031 ignore removed.