Add read-only object-storage immutability audit

[Trifunovich]

Add S3-compatible bucket checks for versioning, optional Object Lock, and optional newest-object freshness.

Acceptance criteria

• AWS SigV4 support is available from the Providers project without changing existing reporting behaviour.
• Configuration validates bucket endpoint, credentials source, and requested controls with actionable errors.
• The audit performs only signed GET requests and reports actionable, stable object-storage findings.
• Doctor and the interactive wizard validate reachable configured inputs, including reject and skip paths.
• Fixtures cover provider response shapes; samples, user docs, changelog, wizard transcripts, and tests are updated.
• Release build and full test suite pass.

No live bucket credentials or topology belong in source, fixtures, ticket discussion, or test output.

[Trifunovich]

Implementation review complete.

• Corrected Object Lock 404/no-default-policy handling, cross-page newest-object selection, bounded-listing behavior, config-only loading, and endpoint validation.
• Doctor and the setup wizard now evaluate the same configured S3 requirements as the audit, including retention and optional freshness.
• Verified Release build with zero warnings and the full suite: 296 passed.
• Live signed read-only verification against the isolated MinIO bench produced the expected versioning finding with no provider error and no S3 write.

PR and solution record will link the shipped commit.

[Trifunovich]

Shipped in RestoreGuard#21, merge commit 51b83b1.

Added read-only S3-compatible bucket auditing for versioning, Object Lock/default retention, and optional bounded newest-object freshness across the audit, doctor, setup wizard, JSON output, documentation, samples, transcripts, and tests. The provider uses signed metadata GET/list requests only; it never writes a probe object or reads object content.

The non-obvious compatibility handling is deliberate: a missing Object Lock configuration maps to the explicit disabled finding, and an enabled configuration with no default rule maps to the default-retention finding. Full verification: Release build (0 warnings), 296 tests passed, CI passed, and the isolated local MinIO bench produced the expected versioning finding with no provider error and no S3 write. The live-test record is in homelab docs/restoreguard-test-deployments.md, commit a679c15.