Scope: private bucket, least-priv IAM, SSE-KMS. AC: no public object access; policy verified. Deploy gate: D0.
Scope: private bucket, least-priv IAM, SSE-KMS. AC: no public object access; policy verified. Deploy gate: D0.