Summary

Phase 2 of the ECS CD-pipeline plan. Stacked on #108 — merge that first, this retargets to dev automatically.

Two independent correctness fixes in deploy-to-ecs.yml, found while reading it for the smoke-gate/rollback work that follows:

• deploy-infrastructure's if: contains(github.event.head_commit.modified, 'aws/cloudformation') only works for single-commit pushes — head_commit isn't populated for a squash-merge, so a CloudFormation change could silently skip infra sync. The CFN deploy is already documented as idempotent (--no-fail-on-empty-changeset), so simplest robust fix is to just run it every push rather than chase a correct multi-commit diff condition. Costs one extra idempotent aws cloudformation deploy call (~10-20s) per deploy.
• deploy-app's if: always() made it run even on a cancelled workflow. Now that deploy-infrastructure always runs (previous commit), it can never legitimately be 'skipped' either, so dropping the if: entirely and relying on the implicit needs: gating (success-only, false on cancellation) is the correct behavior — no explicit condition needed.

Test plan

• actionlint on the modified workflow — no new findings (pre-existing findings are all on lines this PR doesn't touch: outdated action versions, unrelated SC2086 quoting)
• Diffed before/after: exactly the two conditional lines removed, nothing else