feat(storage): add ManagedFolder and Folder, and fix three defects in existing Storage code

[naxty]

Adds the two Storage folder types — and fixes three defects in Storage code that
shipped before this PR.

Branched off main, not stacked on the other batches, so it can be reviewed
and merged independently.

Case	Result
storage-managed-folder	crud 8/8, discovery 4/4
storage-folder	crud 8/8, discovery 4/4
bucket (pre-existing)	passes — included deliberately, see below

Verified through debug-conformance.yml; the local key is 403 on Storage.

The fixes

GCP::Storage::Bucket's resolvable named properties that do not exist. It
pointed at "Id", "SelfLink" and "Name"; the resource declares id and
name in lower case and has no selfLink at all. So bkt.res.name resolved to
no value and any resource referencing a bucket reached the plugin with the
reference unresolved. Latent since it was written, because nothing in the
repository referenced a bucket until these folder types did.

Storage names containing a slash were truncated on a native-ID round trip.
Both folder types are named with a trailing slash that is part of the identity
("reports/" is not "reports"); the parser took a single path segment, so the
slash was dropped and the rebuilt URL addressed something that does not exist.

Neither folder type was discoverable. With no properties, discovery can name
no bucket, so the path builder fell through to its project-scoped branch and
asked /projects/{p}/managedFolders. Now walks the buckets.

Notes for review

This is the only batch that changes shared code green cases depend on, so the
pre-existing bucket case is in the CI run above rather than assumed safe. The
parser change is behaviour-preserving by construction — for an ACL entity, a
default object ACL or an anywhere cache the name is a single segment, so joining
the remainder returns the same string and PathEscape is a no-op — and unit
tests pin that, because the package's own tests are integration-tagged and do
not run without real GCP.

Bucket gains iamConfiguration.uniformBucketLevelAccess and
hierarchicalNamespace: a managed folder requires the first, a folder requires
the second, and neither could otherwise be declared. Both are additive and
optional, with hasProviderDefault on the fields GCS populates itself.

The trailing slash is a type constraint (String(endsWith("/"))), not a
comment, so a fixture that omits it fails at eval rather than after creating a
bucket.

The bucket walker is the sixth copy of this shape in the plugin — Service
Directory, Spanner, Cloud SQL, DNS, Bigtable, Storage. Six packages hand-writing
the same walk because the generic List cannot find a nested resource GCP offers
no wildcard for. It belongs in base; not done here to keep this branch to one
service.

What I could not verify

• HmacKey and Notification are not included. HMAC keys need a PUT state=INACTIVE before delete and a service-account email a fixture cannot
  know; notifications need a Pub/Sub topic plus an IAM grant for the GCS service
  agent.
• The commented-out ObjectAccessControl says base "doesn't support resources
  that need TWO parent properties (bucket + object)". The GrandParentType
  support added in feat(servicedirectory): add Namespace, Service and Endpoint #165 does now provide that — but it is not enough to
  close the gap: an object-scoped ACL needs an object to attach to, and there
  is no GCP::Storage::Object type, so no fixture could create one. Objects are
  uploaded through the media endpoint rather than created through this API
  surface. The gap stays recorded.

---

Correction (2026-08-28): this body reported CRUD as 8/8. That was wrong. The
Replace step reports [~] — skipped, not passed: the harness only runs it when a
testdata/<case>-replace.pkl fixture exists, and no case in this repo has one (0 of
118). Read every 8/8 above as 7 passed, Replace not exercised. The same applies
to every GCP resource already on main — the Replace path has never been covered
here. Nothing in this PR regressed.