feat(s3): implement object lock (per-key version-state tree)

[frrist]

Implements docs/s3-object-lock.md — stacked on #77 (the design). Rebases onto main once the doc lands.

WORM enforcement lives in versitygw's controller (auth.CheckObjectAccess); this backend stores lock state and returns the exact absent-case sentinels (§2). The pieces:

• Schema (bucket/): VersionState{Retention, LegalHold, Tags} blocks under the new "/versionstate/0" union arm; ObjectLeaf.State roots the per-key version-state MST (same revSeqKey keying as the prev tree), joining the existing "/objectleaf/0" key with no compatibility shim per the dev-only data posture (§4.1). Tags is reserved so object tagging lands as handlers with no format change. Manifests are never rewritten: versioning invariant 5 holds verbatim.
• Registry (§4.2): buckets.object_lock_config (verbatim BucketLockConfig JSON), Create takes an initial state so x-amz-bucket-object-lock-enabled buckets are born versioned+locked atomically, multipart_sessions carries the MPU lock headers to Complete.
• Backend methods: the four per-version methods over the §6 check order (s3frontend/objectlock.go), Put/GetObjectLockConfiguration, the PutBucketVersioning suspend guard.
• Write paths: creation-time stamping and delete-path state cleanup run inside the same commits that create/remove versions (§7, §9) — no post-commit windows; Head/Get echo the x-amz-object-lock-* fields (§8).

Conformance (full TestForgeVersity partition green against the smelt stack): six new lock categories, all Versioning_* lock/retention/legal-hold/WORM rows in the pass table, a LockCreation versioned-conf category for lock-enabled-bucket cases from plain-conf groups (their teardown needs ListObjectVersions), the WORMProtection bypass family as XFail (flips when bucket policies land), and promotions incl. Versioning_DeleteObject_non_existing_objects and CreateBucket_default_object_lock. Three details the run pinned are folded back into the doc: key existence outranks the lock gate, the missing-config error's variant split, and the controller's zero-time retain-until pointer.

Note on the earlier CI run: TestForgeReadAfterCatalogRetention failed at stack boot with a Docker setns exec error (compose up), before any request ran — the same binary passed six other stack boots in that job. It passes locally against this head.

🤖 Generated with Claude Code

[hannahhoward]

LGTM broadly. A few non-blocking comments.

It's really nice this didn't turn out to be that bad.

[hannahhoward]

Not clear the value of this. Why wouldn't you just use the base version? It's just a cborgen annotation worth of difference, unless the nil check on state on marshall is relevant

[frrist]

This wrapper is for decoding since cbor-gen's generated decoders ignore map keys they don't recognize. So if the wrong block ever gets decoded as a StateUnion, we wouldn't get an error, instead we'd get State == nil. The lock code would read that as "no retention, no legal hold" and happily allow a delete, which would be incorrect. So this wrapper turns it into a hard error instead. Same reason EnvelopedManifest and EnvelopedLeaf exist.

[hannahhoward]

should this whole thing be in a transaction? It seems like all the lookups before this line are non mutating? Or is this a multiwriter neccesity so it doesn't mutate from under you?

[frrist]

Yeah, it's for concurrent writers, and this is a read-modify-write. Read the state block, change one field, keep the rest. So if for example, one request is setting retention and another is setting legal hold on the same version, and both read the block before taking the lock, whichever writes second wipes out the other's change. Doing the read inside the lock addresses that edge case. It also means the version can't be deleted out from under us between lookup and write. The reads should be fairly cheap and these calls should be fairly rare, so holding the lock a little longer (ideally) costs (almost) nothing...