feat: add ECS IaCProviderRunner

[intel352]

Implements the optional IaCProviderRunner service for AWS using ECS RunTask.\n\n- registers provider-owned runner service in the typed IaC server\n- launches ECS one-off tasks from portable JobSpec image/command/env\n- supports Fargate when ecs_subnet_ids are configured, otherwise EC2 launch type\n- streams CloudWatch Logs from runner task metadata\n- advertises workflow.plugin.external.iac.IaCProviderRunner and requires workflow v0.73.0\n\nVerification:\n- GOWORK=off go test ./...\n\nRefs GoCodeAlone/workflow#840

[Copilot]

Pull request overview

Adds AWS support for the optional IaCProviderRunner contract by launching one-off ECS tasks from a portable JobSpec, including basic status and CloudWatch Logs streaming, and bumps the plugin/SDK versions to the required Workflow engine level.

Changes:

• Implement interfaces.IaCProviderRunner on AWSProvider using ECS RegisterTaskDefinition + RunTask, and map ECS task state to JobStatus.
• Add typed gRPC server handlers for IaCProviderRunner and tests ensuring SDK auto-registration works.
• Extend AWS provider config contract for runner networking/logging defaults and bump minEngineVersion / module deps to workflow v0.73.0.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
provider/runner.go	Core ECS runner implementation: run job, fetch status, stream CloudWatch logs.
provider/runner_test.go	Unit tests covering Fargate task creation plus status/logs plumbing.
provider/provider.go	Initialize and expose runner config/client; add runner-related config keys and parsing helpers.
provider/provider_test.go	Update canonical keys test to include new runner config keys.
internal/runner_server.go	Typed gRPC handlers for IaCProviderRunner mapping pb ↔ interfaces types.
internal/runner_test.go	Test that runner service auto-registers via sdk.RegisterAllIaCProviderServices.
internal/iacserver.go	Embed/guard UnimplementedIaCProviderRunnerServer and add compile-time assertion.
internal/contracts/aws.proto	Extend typed provider config with ECS runner subnet/SG/execution role/log group.
internal/contracts/aws.pb.go	Regenerated protobuf output reflecting new config fields.
plugin.json	Advertise runner service + bump minEngineVersion to 0.73.0.
cmd/workflow-plugin-aws/plugin.json	Same manifest updates for the cmd distribution.
internal/iacserver_mapper_test.go	Update manifest conformance test for new minEngineVersion.
go.mod / go.sum	Bump Workflow + AWS SDK versions; add CloudWatch Logs SDK dependency.

Files not reviewed (1)

• internal/contracts/aws.pb.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.