step-functions: run ecs task when guard duty runtime monitoring is enabled

### Describe the bug

In our org we have Guard Duty runtime monitoring for ECS enabled.

When running a task inside a step function like this:

```ts
const runTask = new sfnt.EcsRunTask(this, "RunTask", {
cluster,
launchTarget: new sfnt.EcsFargateLaunchTarget(),
integrationPattern: sfn.IntegrationPattern.RUN_JOB,
securityGroups: [sg],
taskDefinition: job.taskDefinition,
comment: "Run ECS Task",
});
```

The task itself is run successfully, but the state still fails due to insufficient permissions regarding GuardDuty.

```
{
"ContainerArn": "*****",
"Cpu": "null",
"GpuIds": [],
"LastStatus": "STOPPED",
"ManagedAgents": [],
"Name": "aws-guardduty-agent-mfjGLB",
"NetworkBindings": [],
"NetworkInterfaces": [
{
"AttachmentId": "*****",
"PrivateIpv4Address": "10.0.0.172"
}
],
"Reason": "CannotPullContainerError: pull image manifest has been retried 1 time(s): failed to resolve ref 323658145986.dkr.ecr.eu-central-1.amazonaws.com/aws-guardduty-agent-fargate:v1.5.0-Fg_arm64: unexpected status from HEAD request to https://323658145986.dkr.ec",
"RuntimeId": "adab51249cea4b5ea2d99cede4bb257e-2987719819",
"TaskArn": "*****"
}
```

Please note that the guard duty agent is not configured in our ECS task, but it is added by AWS if guard duty is enabled.

We can work around this by adding wildcard permissions like this, but it's less than ideal

```
taskDefinition.addToExecutionRolePolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: [
"ecr:GetAuthorizationToken",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:DescribeImages",
"ecr:BatchGetImage",
],
resources: ["*"],
}),
);
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

CDK should add the necessary permissions.

### Current Behavior

Permissions are insufficient.

### Reproduction Steps

**It is not possible to create a self-contained example, as the error originates from account / org specific configuration**.

In our org we have a landing zone with a dedicated security account and an developer account where the ECS task and the calling step function is placed.

Steps:

1. Enable guard duty runtime monitoring
2. Wait until changed guard duty setting take effect.
3. Create an ECS task (does not matter, what it does, but should be a one-off script that executes and exits)
4. Use the cdk step function runTask task.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.173.3

### Framework Version

_No response_

### Node.js Version

22

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start by tracing the Step Functions EcsRunTask construct and its execution-role permission handling, then compare the permissions needed when GuardDuty runtime monitoring injects the ECS agent. Reproduce with the provided EcsRunTask configuration and inspect the synthesized IAM policy. Done means the generated permissions cover this GuardDuty-enabled task without requiring wildcard ECR permissions.

Written by the indexing model from the issue text.