Add Heavy acceptance coverage for lit.cloud Hetzner Object Storage

[litroc]

Context

lit.cloud will contain provider-facing automation. Real Hetzner Object Storage and S3 authorization tests are Heavy under MLX-10 because they use external infrastructure, protected credentials, persistent state, and provider-side policy behavior.

Objective

Define and implement the central Heavy acceptance contract for lit.cloud.hetzner_object_storage.

Scope

• Add a versioned Heavy scenario contract for Hetzner Object Storage.
• Accept an immutable candidate SHA or collection artifact.
• Provision only isolated test resources with deterministic names and ownership labels.
• Validate Plan, Audit, and Reconcile.
• Validate private bucket defaults, versioning, Object Lock at creation, Governance retention, and multipart cleanup.
• Validate separate-project external principals.
• Verify positive and negative actions for Admin, Writer, Reader, and Reviewer.
• Prove that Writer cannot read, delete, or change bucket policy.
• Prove that Reader cannot write, delete, or change policy/retention.
• Prove that Reviewer can inspect required evidence/retention metadata but cannot mutate objects or policy.
• Capture structured JUnit and evidence manifests without secret material.
• Perform idempotent cleanup where Object Lock permits it; document retained locked fixtures and expiry.

Acceptance criteria

• A machine-readable Heavy matrix entry exists for the Hetzner scenario.
• Execution occurs only through modulix-validation.
• Candidate SHA/artifact identity is recorded.
• Positive role tests pass.
• Negative authorization tests fail closed as expected.
• Same-project full-rights behavior is covered as a regression guard.
• Secrets are redacted from logs, JUnit, artifacts, and manifests.
• Cleanup and retained-object handling are deterministic.
• The aggregate result can act as a protected release gate for lit.cloud.

Dependencies

• lightning-it/ansible-collection-cloud repository bootstrap
• Hetzner role migration and external-principal implementation

[litroc]

Parent bootstrap and governance issue: https://github.com/lightning-it/github-management-lit/issues/266\n\nRole migration dependency: lightning-it/ansible-collection-supplementary#567

[litroc]

Implementation is complete and promoted to main, but the issue was closed before the protected provider acceptance actually ran. The exact lit.cloud candidate is 717964979126a50e5525dd295f7140f1cb6a94d2. The GitHub Environment lit-cloud-hetzner-object-storage-heavy currently has no configured credentials, so the four-project Admin/Writer/Reader/Reviewer authorization matrix cannot execute. This issue remains open until the exact candidate passes the protected Heavy workflow with sanitized evidence.