ECS task def on :latest makes no-change Terraform applies silent no-ops

If an ECS task definition references a mutable image tag like :latest, pushing a new image and running terraform/tofu apply reports success with 0 changes, and the running task keeps the old digest (Fargate resolves the tag only at task start). It only appears to work when some other task-def field changes. Fix: pass a per-deploy tag variable (e.g. image_tag = git short sha) into the container image so every code deploy creates a new revision that ECS rolls and the deployment circuit breaker can roll back. Make the deploy script refuse to apply if the plan does not touch the task definition, and verify by comparing the running task imageDigest to the pushed digest.