kosli snapshot ecs fails when a scanned cluster has zero services

[dangrondahl]

Summary

kosli snapshot ecs errors out when any cluster it scans has no ECS services. Instead of reporting zero containers for that cluster, the command fails with:

Error: failed to filter ECS services in cluster <cluster-name>: operation error ECS: DescribeServices, https response error StatusCode: 400, RequestID: ..., InvalidParameterException: Services cannot be empty

This is a regression. Earlier CLI versions handled empty clusters gracefully and reported [0] containers were reported to environment <env>.

Steps to reproduce

1. Have an AWS account with at least one ECS cluster that has no services defined.
2. Run kosli snapshot ecs <environment> without a --clusters filter (so all clusters in the account are scanned).
3. The command fails as soon as it reaches the empty cluster.

Expected behavior

A cluster with no services should contribute zero containers and not cause an error. The snapshot should complete successfully.

Actual behavior

The command aborts with InvalidParameterException: Services cannot be empty.

Root cause

In internal/aws/aws.go, getFilteredECSServicesInCluster calls DescribeServices with the service ARNs returned by ListServices:

describeServicesOutput, err := client.DescribeServices(context.TODO(),
    &ecs.DescribeServicesInput{Cluster: aws.String(cluster), Services: listServicesOutput.ServiceArns})

When a cluster has no services, listServicesOutput.ServiceArns is empty. The AWS ECS DescribeServices API rejects an empty Services list with InvalidParameterException: Services cannot be empty. There is no guard for the empty case.

The regression was introduced in commit 686b31c7 ("Filter ecs by services", #556), which rewrote this code path. The pre-existing code guarded the equivalent describe call with a len(...) > 0 check; the rewrite dropped that guard for the new DescribeServices call. The bug is absent in v2.11.0 and present from v2.11.26 onward (including v2.28.0).

Suggested fix

Skip the DescribeServices call (and the downstream describe in the pagination recursion) when ServiceArns is empty, so an empty cluster simply contributes no services. Add a regression test covering a cluster that returns zero services.