fix(iam): scope repo-level ECR actions

[zhaoqizqwang]

scope repo-level ECR actions to prevent false deny in preflight validation

Split ecr_policy statements in training, serving, and hyperpod role types so that only ecr:GetAuthorizationToken (account-level) remains under Resource: "". The repository-level actions (BatchGetImage, GetDownloadUrlForLayer, BatchCheckLayerAvailability) are now scoped to arn:aws:ecr:::repository/, which excludes them from _get_smoke_test_actions. This prevents SimulatePrincipalPolicy from returning implicitDeny for roles that correctly scope ECR permissions to specific repo ARNs (least privilege), fixing the regression that blocked deploys/training/pipelines for those customers.

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[zhaoqizqwang]

Tested locally using script below and the validation is fixed

for role_type in ("training", "serving", "hyperpod"):
    overlap = set(_get_smoke_test_actions(role_type)) & ECR_REPO_ACTIONS
    status = "❌ BUG" if overlap else "✅ FIXED"
    print(f"  {status} [{role_type}] repo-level ECR in smoke test: {overlap or 'none'}")