fix(cd): keep SHA-tagged API images for rollback

scripts/test-terraform-dev-only.py

@@ -32,6 +32,8 @@ def test_no_hcp_iam_and_no_prod():
     assert "ignore_changes = [task_definition, desired_count]" in ecs
     assert 'path                = "/api/health"' in ecs
     assert "public.ecr.aws/docker/library/node:24-alpine" in ecs
+    assert 'tagStatus   = "untagged"' in ecs
+    assert 'tagStatus   = "any"' not in ecs
     cloudfront = (tf_dir / "cloudfront.tf").read_text()
     assert "cloudfront_default_certificate = true" in cloudfront
     assert "aliases" not in cloudfront

terraform/ecs.tf

@@ -19,11 +19,12 @@ resource "aws_ecr_lifecycle_policy" "api" {
     rules = [
       {
         rulePriority = 1
-        description  = "Keep the last 20 images"
+        description  = "Expire untagged images. SHA tags stay so registered task revisions can roll back."
         selection = {
-          tagStatus   = "any"
-          countType   = "imageCountMoreThan"
-          countNumber = 20
+          tagStatus   = "untagged"
+          countType   = "sinceImagePushed"
+          countUnit   = "days"
+          countNumber = 14
         }
         action = {
           type = "expire"