test(interop): fix the fixture lab's all-cases and SSE-C capture paths

Two defects kept most of the fixture matrix uncapturable, both found by actually running the lab rather than reading it.

`./capture_via_docker.sh all` never worked. With no case ids to forward, `case_args` is an empty array, and `${arr[@]}` under `set -u` aborts on bash 3.2 — still the default /bin/bash on macOS — with "case_args[@]: unbound variable". The build_args array this branch added has the same shape and would have hit it on the CI path, where no mirror overrides are set. Both now use ${arr[@]+"${arr[@]}"}, which is empty-safe on 3.2.

The SSE-C cases could not be captured at all: MinIO refuses SSE-C over a plain-HTTP connection, and the script pinned the lab to its default http endpoint with no way to override. lab.py already provisions a self-signed certificate and speaks https end to end, so this only needed an endpoint passthrough — MINIO_LAB_ENDPOINT, documented alongside the requirement.

With both fixed, one command captures the full six-case matrix (SSE-S3 / SSE-KMS / SSE-C x singlepart / multipart), which is what backlog#1638's D4 matrix has to be measured against.

Refs rustfs/backlog#1638.

crates/rio-v2/tests/minio_fixture_lab/README.md

@@ -34,6 +34,14 @@ MINIO_LAB_PYTHON_IMAGE=public.ecr.aws/docker/library/python:3.12-slim \
 
 Pin the MinIO tag to the same release the Dockerfile names; an unpinned `:latest` captures whatever format that day's build writes, which is not what the interop tests were validated against.
 
+## Capturing the SSE-C cases
+
+MinIO refuses SSE-C over a plain-HTTP connection, so the `sse-c-*` cases cannot be captured against the default endpoint — `./capture_via_docker.sh all` fails on the first SSE-C upload with `InvalidRequest ... must be made over a secure connection`. The lab provisions its own self-signed certificate; point it at the HTTPS endpoint to capture them:
+
+```bash
+MINIO_LAB_ENDPOINT=https://127.0.0.1:9000 ./capture_via_docker.sh all
+```
+
 ## Layout
 
 The default root is `artifacts/minio-fixture-lab`, which is already ignored by the repository.

crates/rio-v2/tests/minio_fixture_lab/capture_via_docker.sh

@@ -12,6 +12,13 @@
 #                                                 # ignored interop tests consume
 #   ./capture_via_docker.sh sse-s3-singlepart-64k # specific case id(s)
 #   ./capture_via_docker.sh all                   # full SSE/size matrix
+#
+# The SSE-C cases are not reachable over the default plain-HTTP endpoint: MinIO
+# refuses SSE-C unless the connection is secure ("Requests specifying Server
+# Side Encryption with Customer provided keys must be made over a secure
+# connection"). Capture those by pointing the lab at its self-signed HTTPS
+# endpoint, which it provisions itself:
+#   MINIO_LAB_ENDPOINT=https://127.0.0.1:9000 ./capture_via_docker.sh all
 set -euo pipefail
 
 IMAGE="${MINIO_LAB_IMAGE:-rustfs-minio-lab:latest}"
@@ -46,7 +53,10 @@ if [ -n "${MINIO_LAB_PYTHON_IMAGE:-}" ]; then
 fi
 
 echo ">> building ${IMAGE}"
-docker build -f "${SCRIPT_DIR}/Dockerfile" -t "${IMAGE}" "${build_args[@]}" "${SCRIPT_DIR}"
+# ${arr[@]+"${arr[@]}"} rather than "${arr[@]}": under `set -u`, bash 3.2 —
+# still the default /bin/bash on macOS — treats an empty array expansion as an
+# unbound variable and aborts.
+docker build -f "${SCRIPT_DIR}/Dockerfile" -t "${IMAGE}" ${build_args[@]+"${build_args[@]}"} "${SCRIPT_DIR}"
 
 echo ">> capturing fixtures into ${FIXTURE_REL}"
 docker run --rm -v "${REPO_ROOT}:/repo" "${IMAGE}" \
@@ -54,6 +64,7 @@ docker run --rm -v "${REPO_ROOT}:/repo" "${IMAGE}" \
     --root "/repo/${FIXTURE_REL}" \
     --work-root /tmp/minio-lab-work \
     --minio-binary /usr/local/bin/minio \
-    "${case_args[@]}"
+    --endpoint "${MINIO_LAB_ENDPOINT:-http://127.0.0.1:9000}" \
+    ${case_args[@]+"${case_args[@]}"}
 
 echo ">> done — fixtures under ${REPO_ROOT}/${FIXTURE_REL}/cases/"