fix(cdk): optimize test suite via shared CDK template synthesis (#195)

* perf(cdk): share CDK templates in task-api tests for 61% faster suite

Refactors task-api.test.ts to synthesize CDK templates once per describe
block via beforeAll instead of per-test. Reduces CDK synth calls from
41 to 11 while preserving all 40 test assertions unchanged.

Before: 371s total Jest / task-api.test 370s wall clock
After:  145s total Jest / task-api.test 89s wall clock

Closes #194

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* perf(cdk): share CDK templates in orchestrator and ECS cluster tests

Applies the same beforeAll template-sharing pattern to:
- task-orchestrator.test.ts: 33 → 12 synths (4 shared + 8 unique)
- ecs-agent-cluster.test.ts: 10 → 2 synths (1 shared + 1 unique)

Combined with task-api.test.ts, total CDK synths across the three
heaviest suites drop from 84 to 25 (70% fewer).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: bgagent <345885+scottschreckengaust@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scottschreckengaust

cdk/test/constructs/ecs-agent-cluster.test.ts

@@ -66,9 +66,14 @@ function createStack(overrides?: { memoryId?: string }): { stack: Stack; templat
 }
 
 describe('EcsAgentCluster construct', () => {
+  let baseTemplate: Template;
+
+  beforeAll(() => {
+    baseTemplate = createStack().template;
+  });
+
   test('creates an ECS Cluster with container insights', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::ECS::Cluster', {
+    baseTemplate.hasResourceProperties('AWS::ECS::Cluster', {
       ClusterSettings: Match.arrayWith([
         Match.objectLike({
           Name: 'containerInsights',
@@ -79,8 +84,7 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('creates a Fargate task definition with 2 vCPU and 4 GB', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::ECS::TaskDefinition', {
+    baseTemplate.hasResourceProperties('AWS::ECS::TaskDefinition', {
       Cpu: '2048',
       Memory: '4096',
       RequiresCompatibilities: ['FARGATE'],
@@ -92,8 +96,7 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('creates a security group with TCP 443 egress only', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::EC2::SecurityGroup', {
+    baseTemplate.hasResourceProperties('AWS::EC2::SecurityGroup', {
       GroupDescription: 'ECS Agent Tasks - egress TCP 443 only',
       SecurityGroupEgress: Match.arrayWith([
         Match.objectLike({
@@ -107,20 +110,17 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('creates a CloudWatch log group with 3-month retention and CDK-generated name', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::Logs::LogGroup', {
+    baseTemplate.hasResourceProperties('AWS::Logs::LogGroup', {
       RetentionInDays: 90,
     });
-    // Verify no hardcoded log group name — CDK auto-generates a unique name
-    const logGroups = template.findResources('AWS::Logs::LogGroup');
+    const logGroups = baseTemplate.findResources('AWS::Logs::LogGroup');
     for (const [, lg] of Object.entries(logGroups)) {
       expect((lg as any).Properties).not.toHaveProperty('LogGroupName');
     }
   });
 
   test('task role has DynamoDB read/write permissions', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::IAM::Policy', {
+    baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: Match.arrayWith([
           Match.objectLike({
@@ -136,8 +136,7 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('task role has Secrets Manager read permission', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::IAM::Policy', {
+    baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: Match.arrayWith([
           Match.objectLike({
@@ -152,8 +151,7 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('task role has Bedrock InvokeModel permissions', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::IAM::Policy', {
+    baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: Match.arrayWith([
           Match.objectLike({
@@ -170,8 +168,7 @@ describe('EcsAgentCluster construct', () => {
   });
 
   test('container has required environment variables', () => {
-    const { template } = createStack();
-    template.hasResourceProperties('AWS::ECS::TaskDefinition', {
+    baseTemplate.hasResourceProperties('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: Match.arrayWith([
         Match.objectLike({
           Name: 'AgentContainer',