Allow isolated deployment workloads

[16francej]

Spec diff: none.

Summary

• allow plugins to opt out of core endpoint and source-auth secret injection
• attach scoped sts:AssumeRole permissions to workload-specific ECS task roles
• safely introduce selected zero-count AWS workloads while preserving exact rollback state
• guard task-role transitions and ownership, vendored Terraform compatibility, and deployment-manifest counts

Verification

• npm test — 511 passed
• npm --prefix cli run build
• root and CLI typechecks
• ESLint and Oxlint
• Prettier and terraform fmt -check
• terraform validate
• independent adversarial review of exact commit 1733529e0ceabf6cbb06f46a0c767afcc839b357 — no findings