[jmgasper]

The dev deployment passed OIDC authentication, image publication and the enhanced scan gate, then ECS rejected RegisterTaskDefinition with ClientException: Tags can not be empty. The existing task has no tags; the deployer submitted tags: [] instead of omitting the optional field.

Omit the registration tags field for untagged definitions and normalize omitted/empty tags only for read-back comparison. Existing tags, including empty values, remain preserved; unexpected added or removed tags still prevent service promotion. Malformed tag responses fail before publication.

AWS command failures now identify the service and operation alongside the existing sanitized error code. Request parameters and raw CLI output remain suppressed, and the scan-retry error suffix is preserved.

Validation:

• All 82 tests pass in the pinned CircleCI executor with networking disabled, including untagged registration/read-back, tagged definitions, tag tampering, malformed tags and safe error diagnostics.
• Read-only reconstruction against the live dev task confirms tags are omitted and all task configuration except the image remains unchanged, including runtime roles and secret references.
• CloudTrail confirms successful enhanced-scan reads followed by the empty-tags registration error. No ECS service update occurred; the previous service remains running.
• Shell syntax and diff checks pass. No IAM or scan-gate changes are required.

After merging, publish v2.0.5 and update the Challenge API tag/commit pin through a develop PR for the next deployment attempt. Actual registration and healthy rollout remain live acceptance checks.