feat(ecr): migrate IAM to infrastructure/aws/iam/ecr module

[sebastiancorrea81]

Summary

• Creates new infrastructure/aws/iam/ecr module following the same layer separation as external_dns and agent IAM modules
• Moves all AWS IAM resources (application role, ECR manager policy, build workflow user/access key) out of nullplatform/asset/ecr/iam.tf into the new IAM module
• Adds optional cross-account ECR pull support via enable_cross_account_pull + pull_account_ids variables
• nullplatform/asset/ecr now only manages nullplatform_provider_config and receives IAM values as input variables

Why

IAM resources (AWS layer) were mixed inside a NullPlatform-layer module. This blocked tracking repository_policy_pull_accounts changes because nullplatform_provider_config.ecr requires ignore_changes = [attributes] to prevent drift from agent mutations. By owning IAM in the infrastructure layer, Terraform tracks all AWS permission changes correctly without workarounds.

Migration notes

Existing deployments require tofu state mv for the 6 IAM resources before applying:

tofu state mv module.nullplatform_asset_repository.aws_iam_role.nullplatform_application_role               module.ecr_iam.aws_iam_role.nullplatform_application_role
tofu state mv module.nullplatform_asset_repository.aws_iam_policy.nullplatform_ecr_manager_policy          module.ecr_iam.aws_iam_policy.nullplatform_ecr_manager_policy
tofu state mv module.nullplatform_asset_repository.aws_iam_user.nullplatform_build_workflow_user            module.ecr_iam.aws_iam_user.nullplatform_build_workflow_user
tofu state mv module.nullplatform_asset_repository.aws_iam_access_key.nullplatform_build_workflow_user_key  module.ecr_iam.aws_iam_access_key.nullplatform_build_workflow_user_key
tofu state mv module.nullplatform_asset_repository.aws_iam_role_policy_attachment.ecr_manager_policy        module.ecr_iam.aws_iam_role_policy_attachment.ecr_manager_policy
tofu state mv module.nullplatform_asset_repository.aws_iam_user_policy_attachment.ecr_manager_policy_user   module.ecr_iam.aws_iam_user_policy_attachment.ecr_manager_policy_user

Test plan

• tofu plan shows 0 destroy after state mv
• tofu apply creates only new cross-account IAM resources
• Second tofu plan shows no drift on nullplatform_provider_config.ecr

🤖 Generated with Claude Code

[sebastiancorrea81]

Won't fix / acknowledged. This group is exclusively for a CI/CD build workflow user that authenticates via programmatic access keys (no console login). MFA enforcement at the group level would require the access key to call sts:GetSessionToken with an MFA token on every CI run, which is not compatible with standard CI/CD pipelines. The attack surface is already minimized: the user has a scoped policy limited to ECR operations only.