controlplane: no role erases a volume's signed history, and runners read who wrote it

[aledbf]

F6c (spin F6, spec spin#259).

What changes

• The boundary denies s3:DeleteObjectVersion on volumes/*/HEAD and writers/* for every role, with no condition.
  • Past object_lock_days, the lock no longer keeps a version. Erasing the newest HEADs of a volume nobody wrote since would be a rollback a restore believes.
  • This corrects the spec's limit 2. The control plane's role does hold DeleteObjectVersion, because Restore lifts a delete marker, which is a version. As you pointed out, the UI's delete and restore are the database's soft delete (trashed_until), and a purge crypto-shreds the volume. So nothing in spin needs to lift a marker on a HEAD or a writer's record.
• The runner scope reads writers/*, to hold a HEAD to its writer, and writes none of it. Only the control plane says who a writer is.

spin's per-host session policy needs the same reads (spin#264). Without both, a restore on AWS is refused.

Tests

• New run: a_volumes_signed_history_is_erased_by_nobody. It checks:
  • the Deny on HEAD and writers versions;
  • BypassGovernanceRetention denied;
  • the runner reads writers/*;
  • no runner statement writes there.
• I planted the HEAD resource's removal from the boundary and the run failed ("a role can erase a version of a volume's HEAD"), then reverted it.
• task lint passes: 42 module tests.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}