[aminsammara]

Problem

The first testnet run of the single-instance indexer deploy (run 40290129437) built the image, with the testnet provider metadata from #123, and then failed at the push:

name unknown: The repository with name 'atp-indexer-testnet-atp-indexer' does not exist in the registry

The workflow pushes to atp-indexer-<env>-atp-indexer, the ECS fleet's ECR repository. The fleet's terraform owns that repository with force_delete = true, so it only exists while the fleet does:

• Prod: still has it, and every successful single-instance deploy so far has been prod.
• Testnet: lost it when the testnet fleet was retired.

The single-instance README deploys testnet from staking-dashboard-testnet-atp-indexer instead.

Fix

Resolve the repository at deploy time:

1. Use atp-indexer-<env>-atp-indexer or staking-dashboard-<env>-atp-indexer, whichever exists.
2. If neither exists, create atp-indexer-<env>-atp-indexer with the old terraform's settings: mutable tags, scan on push.
3. Log the repository it used.

The box's role allows ecr:BatchGetImage on repository/* in the account, so the box can pull from whichever repository is chosen. Prod resolves to the repository it uses today, so it's unchanged.

If the workflow role can't create repositories, the step fails with an explicit AccessDenied instead of the push error.

After merge

Rerun Deploy ATP Indexer for testnet (single instance, new_schema empty). Then /api/providers/50 should return TestInc instead of mainnet's Staker Space.