s3_backup_agents and s3_backup_jobs get full CRUD for s3-user (own records),
s3-manager (account-wide), and s3-admin (cross-account). s3_backup_job_runs
is read-only for user/manager since runs are written by
BackupAgentCommandService/BackupAgentEventService on the agent's behalf, not
by a user form (BackupJobRunsObserver doesn't gate creation for the same
reason); s3-admin gets full CRUD on runs too, matching the existing
audit_logs/webhook_deliveries asymmetry for support/cleanup access.