fix: harden iac-code Web ECS deployment flow

[guima-why]

What changed

• Install the latest iac-code release in the ECS bootstrap instead of pinning a template parameter.
• Seed Alibaba Cloud OAuth credentials with the ROS stack region and use deepseek-v4-flash-0731 as the default model.
• Keep the iac-code Web deployment candidate on the intended single-ECS + EIP topology with port 8766.
• Preserve structured ROS stack results through A2A events and Web output derivation while retaining compatibility with diagnostic text appended to tool output.
• Cover stack ownership when a stack is observed before the terminal deployment result.

Why

ROS deployment diagnostics can make the display content no longer valid JSON, which prevented stack outputs from reaching the Web output panel. The deployment template also pinned an older package version and did not align its cloud region and model defaults with the deployed stack.

Impact

Pipeline deployments use the latest published iac-code package, start with the correct Alibaba Cloud region and model defaults, and reliably surface ROS stack results in the Web UI.

Validation

• make lint
• 371 passed targeted tests
• make test: 13545 passed, 2 skipped
• Independent Codex and Claude Code compatibility reviews: PASS