eleven / ocho Public

server: fix mesh_peer_boxes' stats prefix to match where PutStats writes (#842)

Found by re-verifying the exact S3 key path before flipping the mesh
on for real: mesh_peer_boxes listed "s3://bucket/<prefix>-stats/", but
PutStats (internal/activator/heartbeat.go's statsKey) actually writes
to "s3://bucket/<prefix>/mesh/members-stats/<peer>" — hc.meshPrefix()
(activator.go) is "<prefix>/mesh/members", and statsKey appends
"-stats" to that WHOLE path, not to the bare hibernation prefix.

The mismatch was invisible in every test so far because both the
correct and wrong prefix are empty today (the mesh has never been on,
so nothing has ever published to either) — a passing "returns []"
result proved nothing about which path was actually being read.

Verified properly this time: uploaded a synthetic stats object to the
real path Go would use, using the shared activator-prod credentials,
then confirmed the fixed function finds and correctly parses it using
the status-publisher's actual restricted (read-only, *-stats/* scoped)
credentials — the exact ones it runs with in production. Cleaned up
the test object afterward. Dry-run fixtures regenerate identical to
committed (this code path never runs in dry-run mode).

The Terraform grant from #822 needs no change: its "*-stats/*"
StringLike pattern already matches the real path correctly (it never
assumed a specific prefix depth).

Co-authored-by: Claude <noreply@anthropic.com>