fix(cloudfront,logs,kinesis,s3): persist dropped fields + real promote/disassociate (1.13)

[vieiralucas]

Summary

MED round-trip-drop fixes from the 2026-06-24 bug hunt (finding 1.13):

• CloudFront UpdateDistributionWithStagingConfig only bumped the ETag; the staging config never reached the primary. Now promotes the staging distribution's config onto the primary and clears its Staging flag.
• CloudFront ListDistributions hardcoded <Staging>false</Staging>. Now reports each distribution's real staging flag.
• Logs DisassociateSourceFromS3TableIntegration was a no-op, so ListSourcesForS3TableIntegration kept returning a removed source. Now removes the matching source.
• Kinesis DescribeStreamSummary omitted WarmThroughput and MaxRecordSizeInKiB, so UpdateStreamWarmThroughput/UpdateMaxRecordSize never read back. Now reported once configured.
• S3 PutBucketVersioning dropped MfaDelete; GetBucketVersioning omitted it. New Bucket.mfa_delete field (serde-default, snapshot-compatible) persists + echoes it.

Test plan

• update_distribution_with_staging_config_swaps_etag extended: promoted prod carries the staging config's comment + Staging=false.
• s3_table_integration_stubs (unit) extended: ListSources returns 0 after disassociate.
• kinesis_stream_summary_reports_warm_throughput_and_max_record_size (e2e).
• s3_bucket_versioning_put_get extended: MfaDelete round-trips.
• clippy + fmt clean across all five crates.

Surface

No new external API surface. Bucket.mfa_delete is #[serde(default)] in both runtime state and the persistence BucketMeta, so existing snapshots load unchanged.

---

Summary by cubic

Fixes round-trip drops across CloudFront, Logs, Kinesis, and S3 so configs and settings persist and read back correctly. Implements real promotion/disassociation behavior for better API parity.

• Bug Fixes

  • CloudFront: UpdateDistributionWithStagingConfig now promotes the staging config to the primary and sets Staging=false on the promoted primary; ListDistributions returns each distribution’s real Staging flag.
  • Logs: DisassociateSourceFromS3TableIntegration now removes the source; ListSourcesForS3TableIntegration no longer returns disassociated sources.
  • Kinesis: DescribeStreamSummary now includes WarmThroughput and MaxRecordSizeInKiB once configured.
  • S3: PutBucketVersioning persists MfaDelete; GetBucketVersioning echoes it. Added Bucket.mfa_delete in persistence.

• Migration

  • None. Bucket.mfa_delete uses serde defaulting; existing snapshots continue to load.

^{Written for commit 27fe6d1. Summary will update on new commits.}