feat: Phase 2 — ECS Service migration, auto-restart for always-on agents

Fargate ECS Service (replaces RunTask):
- start: create_service(desiredCount=1) or update_service(desiredCount=1)
  with per-agent task definition (env vars baked into task def revision)
- stop: update_service(desiredCount=0) — preserves service definition
- reload: update_service(forceNewDeployment=True) — ECS rolling replacement

Code changes:
- Extracted _resolve_bot_tokens(), _build_agent_env(), _ecs_service_name()
- Each agent gets its own task definition family: {stack}-ao-{service_name}
- register_task_definition clones base task def with agent-specific env vars
- Removed _launch_personal_always_on() (dead code — start_always_on_agent
  handles both personal and team agents)

IAM: added ecs:RegisterTaskDefinition, CreateService, UpdateService,
DeleteService, DescribeServices to EC2 instance role

Deployed and tested:
- Dickson ECS Service created (agent-exec-dickson, desiredCount=1)
- Container running, responds via Tenant Router → Claude Sonnet 4.6
- Known issue: entrypoint.sh ECS metadata IP parsing fails — needs fix
  (endpoint manually registered as workaround)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JiaDe