Ship S3-compatible external payload storage

[rmcdaniel]

Summary

• include the Flysystem S3 adapter and a dedicated process-configured S3-compatible payload disk in the Server image
• let namespace policies select that shared disk without storing provider credentials in namespace metadata
• report bounded configuration failures through discovery and storage diagnostics
• qualify write, cold-process read, corruption rejection, and deletion against a pinned MinIO image in CI

Verification

• 99 targeted tests, 2,826 assertions against a real MinIO service
• process-boundary binary payload round trip, deliberate object corruption, integrity rejection, and deletion
• environment contract/auditor: 18 tests, 1,733 assertions
• Composer manifest validation and locked dependency audit
• source-release synchronization, config cache, Compose rendering, changed-file Pint, and public-boundary check

Closes #102

[rmcdaniel]

The prior CI failure was a stale exact-string assertion in PhpunitFeatureWorkflowContractTest, not an S3 behavior failure. The assertion now checks the required Docker invocation and CORPUS_BASE_REF forwarding independently, preserving the contract while allowing the job-scoped network and MinIO arguments.

This update also synchronizes the release source as Server 2.0.4 and Helm chart 0.1.75. Local verification includes the focused 6-test/94-assertion workflow contract, all 72 Docker-isolation policy cases, and all 3 source-release generation cases.

[rmcdaniel]

Release decision: this branch is now rebased onto current main, so the published image will contain both S3-compatible payload storage and the merged tenant-scoped runtime credential API from #109. Both are additive public capabilities, so the source release is 2.1.0 (Helm chart 0.1.75) rather than a 2.0.x patch.

Local verification after the rebase: source-release synchronization check passed, all three source-release generator tests passed with PHP available, and composer validate --strict --no-check-publish passed with only the existing exact workflow-package pin warning.