Document how a project gets a scoped permission for its container

### Dependency

- [ ] hackforla/incubator#194 — the `project` tag standard, whose exceptions this documentation has to reproduce accurately

### Overview

We need written guidance on how a project team gets a new AWS permission for its running container, because the `container` module's task role is the intended extension point for this and there is no documented convention for using it.

### Action Items

- [ ] Document the **task role** as the place project-specific application permissions go, and the **execution role** as the place they do not. The distinction is not obvious and the role names in this account actively mislead: the shared execution role is named `incubator-prod-ecs-task-role` while the real task roles are named `ecs-container-*`.
- [ ] Write a worked example — granting a container read and write access to one S3 bucket — showing the policy scoped by the `project` tag.
- [ ] Include the exceptions from the tag standard, so a reader does not attempt something that cannot work: S3 requires per-bucket ABAC enablement, and `ecr:GetAuthorizationToken` cannot be scoped at all.
- [ ] Say what a project team should do to request a permission: which repository, which issue template.
- [ ] Publish on the incubator wiki and link it from the `container` module README, whose `task_role_arn` output description already says the role is "Good for setting up permissions like s3 access" without saying how.
- [ ] After publishing, confirm the page renders and its links resolve. A wiki page is not delivered as a pull request, so this check is the only review it gets.

### Resources/Instructions

- The module output to link from: `terraform/modules/container/outputs.tf`, `task_role_arn`.
- Adjacent and worth cross-linking rather than duplicating: hackforla/incubator#120 documents setting up a project's CI/CD pipeline.

Read hackforla/incubator#194 for the project-tag standard, then inspect terraform/modules/container/outputs.tf at the task_role_arn output. Document the task and execution role distinction, the scoped S3 example and stated exceptions, plus the permission-request repository and issue template. Publish it on the incubator wiki, link it from the README, and confirm the page renders with working links.

Written by the indexing model from the issue text.