Cloud-SDK extraction B/C/D — PR 3: serve s3 IaCStateBackend

[intel352]

Summary

• Ports workflow's S3-compatible IaC state store into the aws plugin (internal/statebackend/s3.go) and serves it as the s3 backend via pb.IaCStateBackendServer + the Configure RPC.
• DO-specific behavior stripped from the aws copy: the DO_SPACES_* credential env-var fallbacks and the <region>.digitaloceanspaces.com endpoint derivation — an aws s3 backend uses an explicit endpoint config (S3-compatible) or the SDK's standard AWS S3 endpoint resolution, never a DO URL.
• Lazy construction via Configure (the azure precedent); workflow pinned to PR 1 merge 522748f3.

Plan PR 3 (cross-repo) of the cloud-SDK-extraction B/C/D plan. PR 4 (storage.s3 + step.s3_upload + credentials) follows on the same repo.

Test plan

• go build ./..., go test ./... green incl. host conformance
• Configure builds store; 6 state RPCs round-trip; ListBackendNames → ["s3"]; state-RPC-before-Configure → FailedPrecondition
• spec + quality review passed (zero Critical/Important)

🤖 Generated with Claude Code