carlos / platform Public

Self-serve object storage (#381), stages 1-8, plus the IAM that makes any of it able to provision.

An account applies, a deployment operator approves it once, and every app in that account then gets a store from carlos store create alone. The per-app grant verb survives unchanged for unapproved accounts, --bucket adoption and repair.

Also lands #368's other half: the host role has never been able to create a bucket or an IAM user, so every deployment that set CARLOSSTOREBACKEND and nothing else would have failed at its first grant against live AWS. The grant ships with a permissions boundary, because a role holding CreateUser and PutUserPolicy without one can mint a principal wider than itself.

Built by codex (gpt-6-astra) from a committed brief, reviewed by Fable 5.1, copy reviewed by Paul over two rounds.