After tofu apply, resolve the latest ACTIVE task definition by family and wait until its container image tag is the commit just built. If it is still a previous revision after 20 seconds, fail before run-task.
This closes the window where the apply has finished but the task starts on the old revision, which silently runs the previous image for the entire crawl.
bash -n and prek pass. No application image change.