fix(scale-set): implement review followups

[edersonbrilhante]

Description

This PR addresses the review feedback from PR #5299 and documents the experimental scale-set provider.

Changes include:

• Remove SSM write-back from the read-only controller task role.
• Require an explicit controller image and recommend immutable digests.
• Scope private ECR permissions to the repository and enable them only for private ECR images.
• Align scale-set CloudWatch log retention with the repository default of 180 days.
• Rename scale-set logging input from kms_key_arn to kms_key_id.
• Preserve logger error redaction by passing raw Error objects.
• Remove duplicate startup logging.
• Document HTTPS egress trade-offs and GitHub Meta API ranges.
• Update the pinned harden-runner version.
• Add the scale-set architecture, lifecycle, security boundaries, configuration defaults, migration guidance, and example navigation.
• Document that the TypeScript controller owns GitHub scale-set API operations; Terraform provisions only the AWS controller infrastructure.
• Add an ADR describing scale-set runtime ownership and lifecycle behavior.

Related Issues

Fix #5470 #5471

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/lambda.yml