fix: resolve EC2 instance ID by tag instead of static secret

[gf5901]

Summary

• Replace static Ec2InstanceId SST secret with runtime ec2:DescribeInstances lookup filtered by Role=task-forge-runner tag
• Result is cached per Lambda cold start (one API call max), falls back to EC2_INSTANCE_ID env var if set
• Updated all 4 Lambda packages (API, Autopilot, Metrics, RepoScanner) and removed the secret from sst.config.ts

Motivation

Spot instance replacements change the instance ID, causing all SSM SendCommand calls to fail with InvalidInstanceId. This required manually updating the SST secret and redeploying. With tag-based lookup, new instances are discovered automatically as long as they carry the Role=task-forge-runner tag.

Test plan

• All 4 Lambda packages build with esbuild
• API typecheck, lint, and tests pass
• Deployed to production via sst deploy
• Verified API health check returns OK
• Manually invoked Autopilot Lambda — successfully resolved instance by tag and triggered SSM command

Made with Cursor