Add bounded BytePlus provider conformance evidence

[wms2537]

What changed

• add a TOS conformance runner covering bucket HEAD/create, direct PUT/GET/HEAD, presigned GET/PUT, expected post-delete failure, and verified cleanup
• emit a versioned, bounded evidence record with exact source provenance, adapter/tool/API metadata, credential boundary, exercised capabilities, and explicit untested/unsupported semantics
• sanitize provider and presigned-transport failures and bound chunked response reads
• publish a provider-conformance matrix that distinguishes historical demonstrations from current live release evidence
• document that interactive bp login belongs in the operator's normal host browser, while containers only consume explicitly granted credentials

Why

Historical BytePlus smoke results were useful demonstrations but could be mistaken for release-current provider conformance. TOS evidence also lacked a complete provenance, cleanup, failure, and redaction contract. This PR creates the first provider slice that satisfies that contract without reintroducing the vulnerable TOS SDK.

Advances #26. It intentionally does not close the issue: ModelArk, sandbox, and the remaining provider classifications still require current evidence.

Validation

• focused TOS tests: 10/10 passed
• complete suite: 303/303 passed
• TypeScript typecheck and production build passed
• exact clean-commit controlled-alpha release gate passed at e2665c98cb14333ca5f17e4f5064af81e8638df4
• dependency audit: zero production findings
• two independent review axes reported no remaining actionable findings
• GitHub Actions release gate completed successfully

Live TOS evidence

The exact committed revision was exercised against BytePlus TOS in ap-southeast-1 on 2026-07-19T16:24:46.520Z.

• evidence ID: byteplus-tos-56861a83-c502-4814-a17a-ba7e60d3661a
• record SHA-256: 6093edba37293d28be2725e2ccf0189bb2a81f819fef30f54b11be7bd92d9b16
• source: clean Git worktree at e2665c98cb14333ca5f17e4f5064af81e8638df4
• runtime/protocol: Node.js v24.14.0, native fetch, TOS4-HMAC-SHA256
• credentials: temporary session grant; no credential values serialized
• passed: bucket HEAD/create-if-missing, direct PUT/GET/HEAD, presigned GET/PUT, expected deleted-object 404
• cleanup: both disposable objects deleted and independently verified absent; configured bucket retained
• redaction: no payload, presigned URL, authorization material, or credential value in the record

The full bounded record is retained outside the repository with mode 0600. Bucket ACL/policy, encryption attestation, multipart upload, versioning, and bucket deletion were explicitly not tested.

Release boundary

This PR remains draft and creates no release tag. TOS live evidence now exists for the exact head commit, but provider-matrix promotion still requires provider-focused review. Issue #26 remains open for the other provider surfaces.