feat(backups): support verified S3 object storage

[Coding-Dev-Tools]

Summary

• add encrypted commercial-backup delivery to private S3-compatible object storage, including Railway Buckets
• verify the uploaded object by reading it back and comparing its complete SHA-256 digest before publishing readiness
• keep only a credential-free v2 status marker on the live volume and preserve the existing filesystem backup path
• enforce HTTPS, complete credentials, bounded prefixes, remote retention, and fail-closed readiness

Verification

• ruff check engraphis/commercial.py tests/test_commercial_ga.py
• python -m pytest tests/test_commercial_ga.py tests/test_commercial_backup.py -q

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b0433055a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Paginate remote retention cleanup

When this prefix contains more than the first S3 listing page of backup objects (for example, after a long-running deployment or after a prior retention failure), list_objects_v2 returns only the first page and this code never follows IsTruncated/NextContinuationToken. Objects on subsequent pages are never considered for deletion, so the advertised remote retention policy silently stops bounding storage growth. Iterate all pages (and batch deletes as needed) before returning success.

Useful? React with 👍 / 👎.