fix(admin): merge unreadable-config marker with isolated diagnostics

rustfs/rustfs#7225 and rustfs/backlog#2309 refactored the same ten
per-config arms of ExportBucketMetadata concurrently. Keep #7225's
`exported_bucket_config` helper, `export_internal_error`, the
`?diagnostic=true` mode with its reserved `_diagnostic/` namespace,
manifest and import preflight, and re-apply #2309's semantics on top.

The helper now returns `ExportConfigError`, which separates a
configuration that is stored but undecodable from a failure of this
build's own serialization. An ordinary export records the former in
`<bucket>/rustfs-unreadable-configs.json` and continues, so one bucket
cannot abort a whole-cluster export, and fails closed on the latter.
Diagnostic mode is unchanged: it reports both through the archive-wide
manifest with a fixed code and no parser detail.

The #7225 assertion that a complete export fails closed on unreadable
targets is replaced by assertions of the new behaviour; every other
assertion on both sides is kept.

The s3_error! baseline is remeasured at 1589 for the merged tree.

scripts/check_s3s_footprint.sh

@@ -50,12 +50,13 @@ cd "$(dirname "$0")/.."
 # s3_error! stays flat at 1616.
 # 1616 → 1613 on 2026-09-02: dependency refresh verified the current tree has
 # already shed three s3_error! invocation lines; retighten the line counter.
-# 1613 → 1580 on 2026-09-06: rustfs/backlog#2309 folded the ten per-config
-# arms of ExportBucketMetadata into `export_config_bytes`, which reports an
-# unreadable configuration as a plain string instead of raising an S3 error per
-# arm (33 invocation lines removed from rustfs/src/admin/handlers/bucket_meta.rs).
+# 1613 → 1589 on 2026-09-06: rustfs/backlog#2309 and rustfs/rustfs#7225 both
+# folded the ten per-config arms of ExportBucketMetadata into one helper, which
+# now reports an unreadable configuration as a plain string instead of raising
+# an S3 error per arm (24 invocation lines removed from
+# rustfs/src/admin/handlers/bucket_meta.rs; measured after merging the two).
 S3S_IMPORT_FILES_BASELINE=213
-S3_ERROR_LINES_BASELINE=1580
+S3_ERROR_LINES_BASELINE=1589
 # ecstore-scoped ratchet (rustfs/backlog#1842): the storage engine must not
 # know S3 wire/DTO types (ARCHITECTURE.md invariant 4). The S3-*consuming*
 # client was extracted to crates/s3-client, where s3s usage is legitimate;

scripts/test_security_workflow.py

@@ -355,6 +355,8 @@ fi
                 self.assertFalse(any(line.strip().startswith("continue-on-error:") for line in self.steps[handoff]))
                 self.assertIn("        if: always()", self.steps["Cleanup environment (after)"])
                 self.assertLess(list(self.steps).index("Cleanup environment (after)"), list(self.steps).index(handoff))
+                initialized = self.run_step("Initialize functional evidence")
+                self.assertEqual(initialized.returncode, 0, initialized.stderr)
                 suite = self.directory / "auto-testing/rustfs-replication-test.sh"
                 suite.write_text('#!/bin/sh\nprintf "suite failed\\n" >> "$EXECUTED"\nexit 17\n')
                 failed = self.run_step("Run replication suite")