docs: record ECS agent subpackage move

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -268,6 +268,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `d064924e6` | `cmd/eks-webhook-cert` (implementation) | `spinifex/agents/eks/webhookcert` | Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. `cmd/eks-webhook-cert` keeps the `-dir`, `-cn` and `-dns` flags, parsing, the usage text, the `fipsboot` import, the `eks-webhook-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. Moving out of `cmd/` brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. |
 | `fba330b86` | `cmd/eks-konnectivity-cert` (implementation) | `spinifex/agents/eks/konnectivitycert` | Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. `cmd/eks-konnectivity-cert` keeps its five flags and defaults (including `-cn konnectivity-server`), parsing, the usage text, the `fipsboot` import, the `eks-konnectivity-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed. |
 | `ac069d8f3` | `cmd/eks-token-webhook` (implementation) | `spinifex/agents/eks/tokenwebhook` | The control-plane VM's TokenReview webhook is EKS in-guest behaviour. `cmd/eks-token-webhook` keeps the `-addr` flag and loopback default, the environment-derived configuration (`loadConfig`, `envOr`, all eleven `EKS_*` variables, their default paths and the three required-variable errors, with its test), the slog text handler, both log lines and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports neither `flag` nor `os.Getenv`. The binary already returned errors from `run`, so no exit sites changed, and the certificate, kubeconfig, gateway-client and serve order is unchanged. Cancelling `ctx` now closes the server, which the binary never triggers. The relay, handler, certificate, kubeconfig and wire types moved unchanged with their tests; the public certificate's gosec G306 finding is annotated. New `Run` tests cover serving-cert, kubeconfig, gateway-client and listen failures and serving until cancelled. Old and new binaries matched for 12 cases including a live server's `/healthz` and `/authenticate` 405, 400 and 503 responses, file modes, kubeconfig body and log messages. Full preflight apart from the known vulnerability-scan finding passed. |
+| `3c82c69ad` | `cmd/ecs-agent/{runtime,credentials}` | `spinifex/agents/ecs/{runtime,credentials}` | The containerd runtime adapter and the instance-role credential provider are ECS-agent-private mechanism and move under the ECS agent tree unchanged, keeping their package names. `cmd/ecs-agent` is their only importer; its import paths and one comment changed. Both packages now fall under gosec, which reported nothing. ECS agent and subpackage tests passed 10 times under the race detector and in full preflight apart from the known vulnerability-scan finding. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS