Support community deletion in versioned media buckets

[bradseiler]

Summary

• make community media deletion permanent through the version-aware v5 path by enumerating object versions/delete markers under existing tenant-owned prefixes, including never-versioned buckets that surface null version ids
• preserve the S3 ListObjectVersions response stream order across interleaved object versions and delete markers, including marker-only keys, repeated keys, and dual-marker pagination
• fail closed on truncated version-list pages unless both NextKeyMarker and NextVersionIdMarker are present before requesting the next page
• freeze version-aware manifest entries as (key, version_id, kind), delete each entry by explicit version id, and verify absence with ListObjectVersions
• close the reviewer-confirmed git repo announcement race by holding a durable serving-write lease across the external S3 manifest/pointer seed/ensure sequence, so deletion fencing/drain cannot freeze the final storage list before the pointer write completes
• preserve existing deletion safety boundaries: approval/fence/checkpoint behavior, bounded batches, idempotent retry handling, and exclusion of shared fleet-wide CAS blobs
• document the generic S3 permissions required for every v5 community deletion (s3:ListBucketVersions, s3:DeleteObjectVersion), including never-versioned buckets

Related issue

Buzz thread: buzz-deletion-requests / 9e4aabc6-414c-4978-aba7-b9f5228776de

Review feedback disposition

• Helm/IAM docs now state s3:ListBucketVersions and s3:DeleteObjectVersion are prerequisites for every community deletion using the v5 path, including never-versioned buckets.
• Added ignored live MinIO coverage for a never-versioned bucket: list via ListObjectVersions, assert the exact null version-id representation, delete that exact identifier through delete_object_versions, and prove final version-list emptiness.
• Confirmed bucket_versioning_detected has no callers with rg -n "bucket_versioning_detected" -g '!target' -g '!desktop/src-tauri/target' .; removed the dead API rather than retaining an uncalled probe contract.
• Reassessed delete_validate_and_checkpoint_manifest_chunk_with: removed the one-call-site generic seam, inlined the production delete/validate/checkpoint sequence, kept a small extracted object_versions_from_manifest_chunk plus existing validation/detail helpers, and preserved the deterministic partial-ack-before-checkpoint regression.
• Validated legacy v4 resume by adding focused coverage that v4 manifest chunks still decode bare keys for unversioned delete replay. Validated v5 manifest canonicalization/retry stability with focused DB tests for canonical v5 inventory digest round-trip and repeated validation of the same version-entry chunk stream.
• S3 delete permission preflight remains deliberately list-only: ListObjectVersions can be proven non-destructively before fencing; exact DeleteObjectVersion has no safe dry-run and remains an operator/IAM provisioning contract that the live destructive MinIO tests exercise.

Testing

Exact head: 8b68f8af24f01ca7dbf8ad5c1d2206adef17e362

• cargo fmt --check — passed
• git diff --check — passed
• cargo test -p buzz-deletion -p buzz-media -p buzz-relay -- --test-threads=1 — passed serial package suite at exact head (buzz-relay lib: 910 passed / 48 ignored; buzz-relay main: 11 passed; doctests ok)
• docker compose up -d minio minio-init postgres redis
• cargo test -p buzz-relay --lib api::git::transport::track_c_tests::repo_announcement_holds_serving_lease_until_pointer_is_seeded -- --ignored --nocapture — 1 passed; proves repo announcement holds the serving lease until pointer seed completes and deletion fencing/drain waits
• cargo test -p buzz-media --test versioned_minio -- --ignored --nocapture — 2 passed; verifies never-versioned null version ids, exact null-version delete, dual-marker pagination, explicit version delete/retry, marker-only delete-marker retention/removal, suspended-versioning handling when supported, and final ListObjectVersions emptiness against Docker MinIO
• just test — passed full unit + integration suite after temporarily stopping the pre-existing Homebrew Redis service on 127.0.0.1:6379; Homebrew Redis was restored afterward and verified listening on 127.0.0.1:6379 / [::1]:6379
• git push --force-with-lease brad HEAD:seiler/versioned-community-deletion — pre-push hooks passed, including rust-tests and desktop-tauri-checks

Notes:

• Destination safety checked before push: source block/buzz is public OSS in the allow-listed block org; bradseiler/buzz is a real fork of block/buzz, so updating the PR fork is within the public OSS fork workflow.
• The earlier parallel/global-state telemetry callsite failure is not claimed as a product failure; the package suite was rerun serially at the pushed head and passed.

[kirkawolff]

On v0.5.18, first remove member from community. Then member attempts to remove community from their buzz desktop client. They are unable because they do not have permission to contact the community.