P0: ECS multi-container tracking bug — only last container tracked/stopped #656

Summary

The ECS containers map uses task.TaskArn as key, but tasks with multiple containers share the same key. Only the last container created is tracked. StopTask() only stops the last container — all others are leaked.

Additionally:

• Docker container leak on error: If container creation succeeds but ContainerStart() fails, the container is never removed
• No cascade cleanup on cluster deletion: Docker containers continue running after ECS cluster deletion

Impact

P0 — Resource leak. Multi-container tasks leak Docker containers.

Fix

• Use composite key (TaskArn + container name) or store slice of container IDs per task
• Add error-path cleanup for failed container starts
• Cascade container stops on cluster deletion

Files

• services/ecs/docker_runner.go
• services/ecs/backend.go