fix(scale-set): implement review followups

[edersonbrilhante]

Description

This PR addresses the review feedback from PR #5299 and documents the experimental scale-set provider.
Replaces PR #5472

Changes include:

• Remove SSM write-back from the read-only controller task role.
• Require an explicit controller image and recommend immutable digests.
• Scope private ECR permissions to the repository and enable them only for private ECR images.
• Align scale-set CloudWatch log retention with the repository default of 180 days.
• Rename scale-set logging input from kms_key_arn to kms_key_id.
• Preserve logger error redaction by passing raw Error objects.
• Remove duplicate startup logging.
• Document HTTPS egress trade-offs and GitHub Meta API ranges.
• Update the pinned harden-runner version.
• Add the scale-set architecture, lifecycle, security boundaries, configuration defaults, migration guidance, and example navigation.
• Document that the TypeScript controller owns GitHub scale-set API operations; Terraform provisions only the AWS controller infrastructure.
• Add an ADR describing scale-set runtime ownership and lifecycle behavior.

Related Issues

Fix #5470 #5471

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/docker/build-push-action	53b7df96c91f9c12dcc8a07bcb9ccacbed38856a	🟢 7.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 SAST 🟢 9 SAST tool detected but not run on all commits
actions/docker/setup-buildx-action	37fe631027851001ddb9b187196cc803df7f5f0e	🟢 8.6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits
actions/docker/setup-qemu-action	96fe6ef7f33517b61c61be40b68a1882f3264fb8	🟢 8.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 9 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/lambda.yml