feat(snapshot): wire S3-compatible storage

[Chamberlain1998]

Summary

• wire the YuanRong S3-compatible snapshot backend into AKernel image builds, standalone startup, and Helm deployment
• validate storage mode, provider, endpoint, addressing mode, and credential delivery before YuanRong starts
• keep access key, secret key, and temporary token out of process argv by using environment propagation and a mode-0600 standalone env file
• generate an image capability marker only when the packaged openYuanRong core exposes the complete reviewed S3 contract
• pin the YuanRong product commit while using the upstream sandboxd checkpoint-page restore implementation already merged in fix(runtime): harden checkpoint restore paths sandboxd#40

Dependency

This draft is part of the independent post-snapshot feature series:

1. openYuanRong FunctionSystem MR !460
2. openYuanRong integration MR !1031
3. This AKernel PR

The AKernel gitlink pins the product commit e0b8cac6bd19a5c47ff528b628a41e8b0701e65b; the later YuanRong CI commit pins this PR head, so the test topology has no source-code dependency cycle.

Verification

• bash builder/scripts/tests/test-openyuanrong-s3-capability.sh
• bash deploy/standalone/tests/test-pause-resume-wiring.sh
• bash deploy/akernel/tests/test-pause-resume-wiring.sh
• make SHELL=/bin/bash deploy-script-check
• Buildkite build 299: focused S3 tests 105/105, cross-component tests 13/13, MinIO integration 2/2 with multipart upload and cleanup; the overall build later timed out in the unrelated ASAN compile stage
• standalone gVisor validation on ECS covered checkpoint, restore, delete, command/process/filesystem/PTY, and repeated restore without checkpoint residue

Build 299 predates the final rebase. The final YuanRong CI commit must complete a fresh Buildkite run before this draft is marked ready.

Real OBS and OSS credentials were not available, so their provider-specific smoke matrix remains pending.