CI: permissions matrix checks the apps honour read, write and modify rules

Companion to #202. Once the apps infer what a credential can do, that inference needs a test, otherwise it drifts the first time someone touches the connect path. Every S3-compatible store can issue credentials with narrow policies, so the ephemeral container already in CI can cover this without new infrastructure. The way you create those credentials differs per provider, so the test defines the three credential shapes and a small per-provider fixture supplies them.

Where:

- `apps/sparcd-uploader/bench/run.mjs:64-73` starts the store container with root credentials only
- `.github/workflows/uploader-bench.yml:61` is the existing job that boots it
- `packages/s3-safe/src/index.ts:139-145` is where a 403 needs a typed mapping before any of this is assertable

What to do:

1. Define three credential shapes: read-only, full write, and write without delete. Add a fixture step that creates them on whatever store the workflow boots. For today's container that is MinIO's policy admin; Ceph RGW and others get their own step when #197 adds them.
2. Run the uploader and tagger against each and assert what the UI offers. Read-only shows the disabled state, write works end to end, write-without-delete allows uploads but fails cleanly when a delete is attempted.
3. Assert that every blocked action produces a readable message and leaves no partial object behind.

Keep this to one provider for now. The provider matrix stays in #197; this issue is about policy shapes only.

Done when:

- [ ] Three credential shapes exercised in CI
- [ ] Each app's enabled controls match the policy
- [ ] A blocked write fails with a named error, not a stack trace
- [ ] The credential fixture is a separate step that #197 can extend per provider
- [ ] Job runs on changes to the apps or to `s3-safe`

Related: #202 read-only gating, #197 provider matrix, #153 vitest never runs in CI, CulverLab/sparcd-requirements#37 operator user story, #198 meeting notes.

Serves user story: T2, SAM1, M2