R2 token mint parameterized by BucketPurpose (boot + cache entries)

[gunbai-bot]

Stacked on session/royal-moth-86 (adds FabricCacheBlobs); retarget to main once that lands.

What

• gunbc.cloudflare.r2_token_mint_run: mint_origin_token_and_store / r2_mint_bootstrap take a BucketPurpose; the origin is bucket_purpose_origin_standing(purpose). The token name is the purpose's bucket plus the profile suffix, the policy is the profile's bucket-scoped grant over that bucket (unchanged admit_r2_object_{read,write}_api_mint), and the custody secret is derived from the purpose's credential standing through the new gunbc.cloudflare.r2_origin origin_credential_secret_id. There is no second roster of names.
• New entries: run_boot_object_read, run_boot_object_write, run_cache_object_read, run_cache_object_write. Each writes a NEW Secret Manager version. Each standing stays OriginCredentialUnminted until a reviewed row change pins it (OriginCredentialPinned with access_key_id and version). After that, the entry refuses before any Create.
• OriginCredentialUnminted now carries secret_id, so every arm names its custody secret. Boot and cache standings move from MintEntryUnbuilt to Unminted, naming their entries.
• Durable origin: run, run_object_write and run_bucket_admin pass FabricDurableOrigin. Their secret ids are read from their pinned loci and are the same ids as before (witnessed).
• gunbc.cloudflare.boot_origin credential frontier row: the reason is updated (the mint entries exist, the standing is Unminted). The trigger is narrowed to what is still missing: execution plus a pinned version. The row is not dissolved, because no boot mint has executed.
• gunbc.fabric.fabric_blob_r2: the Unminted refusal now names the entry and the secret.

Witnesses (run locally with gunbc run --claim-run, all PASS): cloudflare_r2_origin_mint_run (new: cache write and boot read are scoped to their own bucket and exclude the durable bucket; the custody secret is derived per purpose, durable is byte-identical, unallocated gives none), cloudflare_boot_origin (the Unminted standing names run_boot_object_{read,write}), fabric_blob, cloudflare_r2_bucket_ensure, cloudflare_r2_origin_object.

• Also fixed an inherited red from the base branch: cloudflare_boot_origin_witness_test had a non-exhaustive match missing KeyAddressedCacheBlobs, and resolve refused.

Not in this PR (declared frontier)

• No fleet-converge modes for the four new entries. The fleet identity can't create the new custody containers (project-level secrets.create), and gunbc.cloudflare.r2_mint_secret_access has no per-secret cells for the boot or cache secrets. So a fleet mode today would always refuse. For now the first mints are operator-run via gunbc run --entry dag/gunbc/cloudflare/r2_token_mint_run.dag --function run_cache_object_read (and the other three). Modes and cells come with the follow-up. No live mint was run.

🤖 Generated with Claude Code

[gunbai-bot]

Held-session store op for dashboard node adhoc-2216e018-df5: #13569

Additive: local_store_held_session sealed to gunbc.typecheck_module_store; named windowed k=2 check/release (no store-root list); acquire still lists once because a reclaimed prefix cannot named-gallop from gen 1. Wet control measures one acquire for N commits after the open sweep.

[gunbai-bot]

#13569 follow-up: the wet control was failing floor as an unenrolled DirWithTemplate changed-witness gap (host_effect_refused / route-gap-before-verdict). Enrolled it next to the other materialization_store_local_wet_witness rows in floor_route_gap chunk_09 so the local-repo wet lane can join. Head bfbcfe3164.