fix(apigw,apigwv2,cognito,wafv2,ecs): persist dropped params + validate managed rule groups (bug-hunt)

[vieiralucas]

Summary

Stubs cluster A from the 2026-07-15 bug hunt (findings 1.26-1.30). Five
write-then-read asymmetries where a Create/Update accepted a parameter that the
corresponding Get/Describe never reflected, plus one op fabricating data for any
input.

#	Service	Bug	Fix
1.26	apigateway	UpdateUsagePlan remove op was dead (guard rejected it) → API-stage detach silently no-op'd	Guard admits replace/add/remove
1.27	apigatewayv2	UpdateRouteResponse/UpdateIntegrationResponse wholesale-replaced the record, dropping fields absent from the request	Merge incoming fields onto existing record
1.28	cognito	AnalyticsConfiguration accepted on Create/Update but dropped; Describe showed default	Persist + echo
1.29	wafv2	DescribeManagedRuleGroup returned hardcoded Capacity=50 + fabricated "RuleA" for ANY vendor/name	Validate against real managed-rule-group catalog; unknown → WAFInvalidParameterException; real capacities + rule names
1.30	ecs	CreateService/UpdateService dropped serviceConnectConfiguration; Describe never surfaced it	Persist + echo on PRIMARY deployment

The wafv2 catalog (Common/KnownBadInputs/SQLi with their real capacities and
rule names) is now the single source of truth behind
ListAvailableManagedRuleGroups and DescribeAllManagedProducts, so the three ops
can no longer disagree.

No new public API surface (behavior + validation fixes on existing ops), so no
SDK/docs regeneration needed.

Test plan

• New E2E tests, one per fix:
  • apigateway::usage_plan_api_stage_add_then_remove
  • apigatewayv2::update_route_response_merges_fields
  • cognito::cognito_user_pool_client_analytics_configuration_round_trips
  • wafv2::describe_managed_rule_group_returns_real_rules_and_rejects_unknown
  • ecs::service_connect_configuration_round_trips_on_describe
• cargo build, cargo clippy --all-targets, cargo fmt clean across the five
  service crates + fakecloud-e2e.

---

Summary by cubic

Fixes five write/read mismatches across apigateway, apigatewayv2, cognito, wafv2, and ecs. Parameters accepted on Create/Update now persist to Get/Describe, wafv2 validates managed rule groups against a real catalog, and cloudformation provisioners pass these fields through on create.

• Bug Fixes
  • apigateway: UpdateUsagePlan now honors remove for /apiStages/<apiId>:<stage> so detaching an API stage works.
  • apigatewayv2: UpdateRouteResponse/UpdateIntegrationResponse merge fields on update (partial patch) instead of replacing the record; unspecified fields persist.
  • cognito: AnalyticsConfiguration on user pool clients is stored and returned by DescribeUserPoolClient.
  • wafv2: DescribeManagedRuleGroup checks vendor/name against a catalog and returns real capacities and rule names; unknown groups raise WAFInvalidParameterException. The same catalog backs ListAvailableManagedRuleGroups and DescribeAllManagedProducts.
  • ecs: serviceConnectConfiguration is persisted and echoed on the PRIMARY deployment in DescribeServices; updating with an empty object disables it.
  • cloudformation: Cognito and ECS provisioners now persist AnalyticsConfiguration and ServiceConnectConfiguration supplied in templates.

^{Written for commit 74fc063. Summary will update on new commits.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.