feat(sync): tear down de-configured autoscaling instead of orphaning it

[stevethomas]

Hey, I made a thing! 🥳

Great! Now please answer the following questions to help out your assigned reviewer:

What problems are you solving?

Autoscaling config was additive only — sync created and updated policies/targets but never removed ones that fell out of the manifest. So changing config left orphans that kept running live and were invisible to yolo audit (App Auto Scaling resources aren't taggable):

• Removing request-count-per-target left the request-count policy + its 2 alarms live and still scaling.
• Removing the whole autoscaling block orphaned the scalable target, both policies, and all alarms (the steps weren't even wired when the block was absent).

This makes autoscaling declarative — sync converges live state down to the manifest:

• Remove request-count-per-target → the request-count policy is pruned, cascading its scale-out/scale-in alarms; the CPU policy stays.
• Remove the whole autoscaling block → the scalable target is deregistered, cascading every policy and alarm.
• Adds DELETED / WOULD_DELETE to StepResult so teardown reports as a delete (the third reconcile verb) rather than a misleading SYNCED, and the destructive action is legible at the plan → confirm gate.

Is there anything the reviewer needs to know to deploy this?

• No tasks are dropped on teardown. Deregistering the scalable target reverts the service to a fixed task count frozen at its current live count — bring it down with yolo scale if you no longer need the capacity. The plan surfaces it as web autoscaling: present → absent (WOULD_DELETE) before you confirm.
• Deferral-safe. Pruning diffs live policies against the manifest's intent, never the resolvable-now set, so a request-count policy that's merely deferred (ALB/TG not yet resolvable on a greenfield sync) is never mistaken for one that was removed and deleted. Covered by a test.
• The two autoscaling steps are now wired whenever the web task exists (not only when autoscaling is on), so a fixed app pays one extra DescribeScalableTargets read per sync; both steps no-op when autoscaling was never enabled.
• Out of scope: the queue group's scale-to-zero alarm likely has the same orphan-on-removal gap — separate follow-up.
• 524 Pest (parallel) / pint / phpstan / VitePress all green.

🤖 Generated with Claude Code