fix(runners): pin dedicated host family so mac-m4 (and mac1/c7i) hosts allocate correctly

[coderbirju]

Problem

arm macOS runners were moved to mac-m4.metal in #1117 (correct), but deploys fail instantly with:

The requested configuration is currently not supported. Please check the documentation for supported configurations. Launching EC2 instance failed.

This is not capacity (fails instantly in us-west-2b where mac-m4 is offered) and not the AMI (amzn-ec2-macos-15.7.9 sequoia/arm64 is M4-compatible; there is no separate M4 AMI).

Root cause

The dedicated Host Resource Group created in lib/asg-runner-stack.ts createHostResourceGroup used AWS::EC2::HostManagement with auto-allocate-host: true / auto-release-host: false but did not pin an instance family. With no family pin, the group auto-allocates/retains a stale family — the old mac2 hosts predating the mac-m4.metal move — so EC2 refuses to place a mac-m4.metal instance → "configuration not supported".

Fix

Pin the family the group is allowed to allocate/place hosts for, via the allowed-host-families AWS::EC2::HostManagement parameter, derived per platform/arch so it always matches the launch template's instanceType:

platform / arch	instanceType	pinned family
mac + arm	mac-m4.metal	mac-m4
mac + x86	mac1.metal	mac1
windows	c7i.2xlarge	c7i

auto-allocate-host: true, auto-release-host: false, and the existing AWS::ResourceGroups::Generic config are unchanged. The instanceType logic (#1117), AMI lookup, #1113, and the #1119 $Latest revert are all untouched.

Parameter verification (the key risk)

The obvious guess instance-family is NOT a valid AWS::EC2::HostManagement parameter. The correct, documented parameter is allowed-host-families — an array of instance-family identifiers (e.g. c5, m5; here mac-m4, not the full mac-m4.metal). Verified against:

• AWS Resource Groups User Guide — Supported configuration types and parameters → AWS::EC2::HostManagement: https://docs.aws.amazon.com/ARG/latest/userguide/about-slg-types.html
• AWS::ResourceGroups::Group CloudFormation reference (host-resource-group example): https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-resourcegroups-group.html

Both list allowed-host-families as a supported HostManagement parameter and give a worked example (["c5","m5"]). This is deploy-valid, unlike the instance-family guess.

Verification (real command output, not reasoning)

• npm ci ✅ · npm run build (tsc) ✅
• npm test → 18/18 pass, 12 suites ✅ — includes a new assertion test that the synthesized AWS::ResourceGroups::Group HostManagement config contains allowed-host-families = [mac-m4] (mac/arm), [mac1] (mac/x86), [c7i] (windows), while keeping the existing auto-release-host: false assertion intact.
• Rendered-template dump (in-process app.synth()) confirmed the same values across every dedicated-host runner type.
• CLI cdk synth of the pipeline stacks requires cross-account credentials for the Vpc.fromLookup context provider (tries to assume a lookup role in the target account), so the in-process synth via Template.fromStack is the authoritative local proof.

Operational follow-up (not in this PR)

Existing retained mac2 dedicated hosts in the current host groups must be released so the groups can allocate mac-m4 hosts (auto-release-host: false retained them). This is an operational step handled separately from this code change.