Astra: region HA spec 2, round 13 (provider boundary)

Rev 13 adds §25: spec 2's provider-neutral core versus its AWS adapters, so that a self-hosted deployment without AWS (MinIO bucket, any hosts, DNS) is not made to depend on AWS.

Judge:

1. Is every AWS-specific dependency in spec 2 (and in the spec 1 code it relies on) classified correctly as an adapter, behind an interface?
2. Does any core path in §§5 to 9 still require AWS?
3. Does the no-AWS fallback work: operator-approved enrolment, addresses from host.env, no termination evidence? Is the stated loss (no auto-replace, no failover) complete and accurate?
4. Are the import test and the no-AWS test enough to enforce the boundary?
5. Report only new items.

Give findings P1/P2/P3 with file:line and a failure scenario. End with a verdict: ready for a plan, or not.