storage-canary: prove allowed-prefix list access (TIN-1546)

[Jesssullivan]

Summary

• make tcfs storage canary --json exercise the same allowed-prefix list() permission used by daemon health and index enumeration
• record list_prefix, list_ms, list_count, and listed in the canary report
• require list proof in the storage posture workflow validator so HTTPS/scoped-credential evidence cannot false-green on object lifecycle alone
• document the new production storage bar and let Linux/macOS package smokes override remote_prefix so production reruns can stay inside the scoped gha/storage-posture/... allow policy
• teach the alpha-gate preflight to emit a scoped Linux prefix automatically when Linux smoke reuses the storage posture environment

Why

The production storage posture canary passed write/read/delete and deny-scope proof, but the Linux public package smoke failed because it used gha/linux-postinstall/..., outside the tcfs-storage-prod-smoke credential allow scope. The tightened canary now proves allowed-prefix list access, and package smoke workflows can be dispatched against a prefix that matches the production credential scope instead of widening the S3 policy or misclassifying package failures.

Evidence

• Branch storage posture run with list proof passed: https://github.com/Jesssullivan/tummycrypt/actions/runs/26207145326
• Branch Linux public package smoke passed with scoped production prefix: https://github.com/Jesssullivan/tummycrypt/actions/runs/26207357056
• Earlier wrong-prefix dispatch failed at write as expected: https://github.com/Jesssullivan/tummycrypt/actions/runs/26207079665
• Linux public package smoke that exposed the prefix mismatch: https://github.com/Jesssullivan/tummycrypt/actions/runs/26206785352

Validation

• ~/.cargo/bin/cargo fmt --all -- --check
• ~/.cargo/bin/cargo test -p tcfs-cli storage_canary
• bash scripts/test-linux-postinstall-workflow.sh
• bash scripts/test-release-workflow-fileprovider.sh
• bash scripts/test-tcfs-alpha-gate-preflight.sh
• bash -n scripts/tcfs-alpha-gate-preflight.sh scripts/test-tcfs-alpha-gate-preflight.sh scripts/test-linux-postinstall-workflow.sh scripts/test-release-workflow-fileprovider.sh
• git diff --check

Boundaries

This is branch evidence until PR #433 lands. After merge, rerun the same Linux smoke from main or the next release candidate using a prefix under gha/storage-posture/.... The macOS production FileProvider rename proof still needs a fresh package built after current-main rename-manifest preservation.