Fidelity gaps from the STS/SSM/S3-advanced/Azure-Queue+Table batch (deferred review items)

[NitinKumar004]

Follow-up from the code review of the Tier-1 batch (STS #262, SSM #263, S3 #264, Azure Queues+Tables #265). The self-contained correctness bugs were fixed in-PR; these are lower-severity fidelity gaps deferred for a later pass.

SSM Parameter Store (#239)

• DeleteParameter doesn't strip a :selector suffix the way the read paths do (asymmetric); a stored name containing : becomes unreadable (AWS forbids : in names, so low severity).
• A missing parameter version maps to ParameterNotFound instead of the distinct ParameterVersionNotFound typed error.
• GetParametersByPath/DescribeParameters don't paginate (MaxResults/NextToken ignored); ParameterFilters and tags aren't stored/queryable; SecureString is stored verbatim (no KMS); advanced parameter policies unenforced.

S3 advanced ops (#118)

• ListParts returns an empty part list — the storage driver exposes uploads but not their individual buffered parts; resumable-upload tooling that reads back parts can't reconstruct state. Needs a driver-level per-upload part enumeration.
• Bucket versioning stores only a bool, so Suspended is indistinguishable from never-configured, and there's no object-level versionId history / version-addressable GET/DELETE / real ListObjectVersions.
• UploadPart doesn't enforce the 10000 upper part-number bound; bucketOp sub-resource pre-check falls through for non-GET ?uploads/?versions.

Azure Queues + Tables (#243)

• Inherent: Queue vs Blob collide on /{name}/messages (a blob named messages) and GET /?comp=list — real Azure separates these by the {account}.queue vs .blob hostname, invisible behind cloudemu's single shared endpoint. Resolving needs host-based routing (or per-service endpoints, cf. the standalone-server mode Feature: standalone server mode ('minikube for cloud') so out-of-process apps can point real SDK clients at cloudemu #224).
• Table $filter degrades to match-all on an unparseable expression (only Prop eq 'val' joined by and is supported) — a data-correctness hazard for unsupported operators (gt, ne, or, parenthesized, or values containing " and "); prefer returning an error/empty over match-all.
• Queue enqueue advertises the MessageID as the PopReceipt (Azure returns a usable receipt on enqueue); parseKeyPredicate accepts a single-key entity predicate and returns 404 instead of 400.

Acceptance: address per service with roundtrip tests; the Azure shared-hostname collisions are best solved alongside standalone/per-service endpoints (#224).