feat!: enable remote customer-cloud storage bindings (ALIEN-291)

[lilienblum]

Tracks ALIEN-291.

Summary

• Add an authoritative manager binding-resolution endpoint for remote, customer-cloud Storage resources.
• Expose Rust, N-API, and TypeScript remote-storage bindings with bounded credential refresh, manager rediscovery, and one retry after reassignment or stale authorization.
• Provision exact AWS S3, GCP Cloud Storage, and Azure Blob grants while preserving provider-appropriate ownership across setup, import, update, and teardown.
• Reconcile durable Azure worker dependencies, exact-scope role assignments, and Event Grid delivery across restart, import, and legacy checkpoints.
• Add a public BYOB Storage example and hosted smoke coverage for put, get, head, list, and delete.
• Regenerate the public OpenAPI and client artifacts from their source schemas.
• Add a packages/commands/README.md so the published @alienplatform/commands package has a landing page. It documents the standalone sender and the pull receiver, the ALIEN_COMMANDS_* environment, and the { managerUrl, deploymentId, token } client contract that ships today.

Security and ownership

• Resolution requires the exact deployment/resource, current release, assigned manager, operational deployment state, remote-enabled managed Storage, and the dedicated remote-binding capability.
• Bearer tokens are not forwarded across service boundaries. Manager discovery and short-lived binding tokens are cached separately and refreshed independently.
• AWS credentials carry an exact bucket session policy; Azure returns one-container user-delegation SAS; GCP uses a Credential Access Boundary backed by the generated exact custom role for storage/remote-data-write.
• Azure role-assignment cleanup requires a deterministic assignment identity plus provider-returned principal proof at the exact resource scope; opaque persisted IDs never authorize deletion.
• Direct or unproven GCP credentials fail closed. Credential exchange response bodies and submitted credentials are never serialized into errors.

Breaking changes

• Remove the unscoped /v1/resolve-credentials route.
• Replace BindingsProvider::for_remote_deployment with Bindings::for_remote_deployment.
• Coordinate the public API changes through the next breaking release.

Verification

• cargo test -p alien-manager --lib: 186 passed.
• Manager credential resolver: 11 passed; full-feature infrastructure resolver: 4 passed.
• AWS endpoint parsing: 12 passed, including regional CloudFormation, Secrets Manager, and API Gateway hosts.
• GCP setup/import ownership: 3 legacy ownership-migration tests, setup-managed no-cloud-mutation lifecycle coverage, and the importer round trip pass; Terraform-owned service accounts and exact grants remain under setup teardown while direct-created identities retain runtime teardown ownership.
• GCP dependency-drain cleanup: 2 passed; scoped remote-storage teardown and credential attenuation coverage pass.
• Azure setup/import ownership: 3 legacy ownership-migration tests, 3 importer round trips, and the exact remote-storage Terraform grant test pass; runtime no longer mutates setup-owned UAMI, FIC, or RBAC while direct-setup checkpoints retain teardown ownership.
• Focused Azure storage-trigger reconciliation: 5 passed, including imported-Ready recovery and equal-update drift repair.
• Full Azure worker suite: 72 passed; command-sender reconciliation: 9 passed; exact command-target mutation ordering: 2 passed.
• RUSTC_WRAPPER= cargo check --workspace --all-targets and the comprehensive E2E app check pass on the current branch.
• Binding/access, provider attenuation, permission, generated-client, N-API/TypeScript, example, and smoke suites pass locally.
• cargo check -p alien-platform-api, explicit Rust formatting, generator shell validation, and git diff --check pass.
• Final immutable-SHA thermo review is clean P0-P2 at 660315fb80e6ad84428637c1eb0b1e6eae1742e4.
• Final Fast CI passed at 660315fb80e6ad84428637c1eb0b1e6eae1742e4: https://github.com/alienplatform/alien/actions/runs/30004976992
• The later packages/commands/README.md commit is documentation only and touches no code path, so it postdates the CI and thermo SHA above without affecting them. Its eight TypeScript samples were type-checked against the built package exports, with a negative control confirming the harness rejects nonexistent API.
• Final hosted cloud smoke validation is pending the shared-staging rollout.

[lilienblum]

CI Fast reached and passed lint, TypeScript typecheck, the real bindings addon build, package-layout validation, and the full TypeScript unit suite. It then stopped on the existing alien-cloudformation::generator::aws_open_search_renders_next_gen_collection_with_data_access snapshot-order drift. The same test and field-order-only diff fail on current main in run https://github.com/alienplatform/alien/actions/runs/29750083342. This branch does not touch OpenSearch generation or that snapshot, so I have not added unrelated snapshot churn to this draft.

ALIEN-291-specific Rust, Node addon, TypeScript, IAM dataset, and generated AWS/GCP/Azure artifact checks are listed in the PR body and pass locally.