audit: every ECS/logs boundary must query by the full service name (oab-{ns}-{name})

[brettchien]

Follow-up from #28 (short display name reached ecs:ListTasks → ServiceNotFoundException).

#28 fixed the observe_deployment → instance_status path by carrying the raw
ECS service_name on ServiceStatus and querying by it. This ticket tracks
auditing the other boundaries so no short/display name reaches an ECS or
CloudWatch Logs API:

• Events filter — observe_events / oabctl::fetch_ecs_events takes
  service: Option<&str>. It filters CloudWatch Logs by string (won't 404 like
  ECS), but should still key on the full service name for correct results.
• Any other ECS call taking a service selector — grep for service_name(
  / callers passing a name through; confirm each receives the full name.
• observe_deployment async wiring — the one line not covered by a unit
  test (it needs a recording/mock ECS client to assert instance_status is
  called with svc.service_name). Currently correct-by-construction + guarded at
  runtime by the instance_status oab- check; a recording-client seam would
  close it fully.

Context: reviewed and merged in #28 (thread sign-off). Non-blocking; no known
live-fleet impact today (all real services are 3-segment oab-<ns>-<name>).