Issue # (if applicable)

Refs #37996

Reason for this change

ICluster and ITaskDefinition declare several members optional (?: T), but the concrete classes exposed them through getters typed T | undefined. Under TypeScript's exactOptionalPropertyTypes, a member typed T | undefined is not assignable to an optional ?: T, so consumers who enable that flag hit TS2420 errors and type-checking aws-cdk-lib fails for them outright, e.g.:

error TS2420: Class 'Ec2TaskDefinition' incorrectly implements interface 'IEc2TaskDefinition'.
  Types of property 'executionRole' are incompatible.
    Type 'IRole | undefined' is not assignable to type 'IRole'.
error TS2420: Class 'Cluster' incorrectly implements interface 'ICluster'.
  Types of property 'defaultCloudMapNamespace' are incompatible.

aws-cdk-lib does not build with the flag, so the break is invisible to the library's own compile and only surfaces downstream. This is one package in the sweep tracked by #37996.

Affected members:

• TaskDefinition.executionRole — inherited by Ec2TaskDefinition, ExternalTaskDefinition, and FargateTaskDefinition;
• Cluster.defaultCloudMapNamespace, Cluster.autoscalingGroup, and Cluster.executeCommandConfiguration.

Description of changes

Convert each offending getter to a public readonly x?: T field. Two population mechanisms are used, depending on where the value is written:

• Written after construction (executionRole via obtainExecutionRole, defaultCloudMapNamespace via addDefaultCloudMapNamespace): populated through a small module-private helper that assigns via a Writeable cast. TypeScript forbids assigning a readonly field outside the constructor, so the cast is the minimal escape hatch; the live view is preserved (the property still reflects the post-construction population).
• Written only in the constructor (autoscalingGroup, executeCommandConfiguration): a direct guarded readonly assignment — no cast needed.

The fields stay readonly, matching the original getters (no setter), so the jsii assembly is unchanged — every affected property remains optional: true, immutable: true, i.e. jsii-diff reports no change for this package. The internal ImportedCluster (the fromClusterAttributes path) is updated the same way so the module is fully clean under the flag.

A new per-package aws-ecs/lib/private/writeable.ts holds the shared Writeable<T> type (the package now has more than one set* helper).

Description of how you validated your changes

• Behavior tests: each property is undefined by default, populated from props, and — for executionRole and defaultCloudMapNamespace — correctly reflects the live post-construction population (obtainExecutionRole, addDefaultCloudMapNamespace), including obtainExecutionRole idempotency.
• A package-local guard (aws-ecs/test/exact-optional-property-types.test.ts) that type-checks the package's concrete classes (Cluster, TaskDefinition, Ec2TaskDefinition, ExternalTaskDefinition, FargateTaskDefinition) against their interfaces with exactOptionalPropertyTypes on, asserting the package stays clean. Verified it goes red (TS2375) if the fix is reverted.
• jsii-diff (yarn compat) reports no change for this package — every affected property stays optional: true, immutable: true. (Locally the command also surfaces a few unrelated cloud_assembly_schema removals from the in-flight 2.258.0 release vs the last published baseline; those are not part of this change.) Lint clean; 192 tests pass.

Note on the shared test harness and PR ordering

The guard uses a small shared helper, exactOptionalAssignabilityDiagnosticsForPackage, added to @aws-cdk/cdk-build-tools. Several sweep PRs (one per package) each carry a byte-identical copy of this helper and import it, so they are ordering-agnostic and can land in any order. Whichever lands first establishes the helper; the others can be rebased to drop the duplicate before merge.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license