AWS ECS/Fargate as a runtime — a second emitter tree, not a target value

[lex00]

Split out of #25, which decided that Target distinguishes Kubernetes substrates rather than substrate kinds. A non-Kubernetes runtime is therefore not a new target value — it is a second set of resource modules, and this issue exists so nobody mistakes it for a config change.

What it is not

It is not EKS. EKS is a Kubernetes cluster and belongs to target=kubernetes with cloud seam defaults — that is #23, and it is a different and much smaller problem.

What it actually costs

Every resource module in src/ emits K8s::*:

src/app/          Deployment, Service, Namespace, headless Service, PodDisruptionBudget
src/data/         Postgres Deployment + PVC, CNPG Cluster, spritzer, floci
src/ingress/      Ingress, Certificate, Traefik IngressRoutes
src/secrets/      InfisicalSecret
src/backup/       CronJob
src/observability/ ServiceMonitor, PrometheusRule

None of it survives the move. A Task Definition is not a Deployment with different field names — the unit of scheduling, the health check contract, the service discovery mechanism and the secret injection path are all different shapes.

What does survive, and why that matters

The seam model survives intact, which is the interesting part:

seam	on ECS
postgres	reference against RDS, or a Postgres task
secrets	Secrets Manager / SSM, injected as task secrets
ingress	ALB + target group, replacing Ingress entirely
tls	ACM, replacing cert-manager
backups	the same pg_dump script, as a scheduled task
dataPlane	unchanged — the data plane is an HTTP API and does not care
storage	unchanged — S3 is S3

That table is the argument for doing this at all: the axes this repo is built on are substrate-independent, and only the emitters are not. It is also the argument for it being its own project shape rather than a fourth enum value.

Scope, if it is ever picked up

• A second emitter tree, probably src/aws/, selected by something above target.
• lib/seams.ts refusals re-expressed for ECS — an ALB with no listener certificate is the same class of lie as a certificate nothing terminates.
• The status table gains a whole column, because none of the current rows transfer.

Prior art

#17 preserves tachylogia's AWS design (App Runner / ECS, RDS, Secrets Manager, ALB + ACM, Route 53) written to full depth. Read it before starting — the tier-by-tier resource mapping is the useful part, and it is the only reason this issue can be scoped at all rather than guessed at.

Not scheduled. Filed so the decision in #25 has somewhere to point.