test(e2e): add the outbound target matrix and #7082 postmortem (#7092)

test(e2e): add the outbound target matrix and the replication checksum postmortem

Defense work for rustfs#7082, the regression rustfs#6895 introduced while
fixing rustfs#6853: a fix for one target class changed a client default for
every target class and nothing in tree modeled the other classes.

- docs/postmortems: timeline, root cause, why four defense layers missed
  it, and the SOP for changing any outbound client default; AGENTS.md and
  the adversarial compatibility lens point at it; the two env knobs from
  rustfs#6895 are documented in docs/operations.
- fake_s3_target: reject_aws_chunked_uploads, require_checksum_for_object_lock
  (Content-MD5 always verified), create_bucket_with_object_lock with a
  GetObjectLockConfiguration handler, and a TransportSnapshot on every
  journal record.
- replication_target_matrix_test: six object shapes against four target
  modes with an explicit expectation table; the two rustfs#7082 cells are
  pinned KnownFailing and fail with an XPASS message once the fix lands.
  Wired into e2e-repl-nightly, excluded from e2e-full.

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=a45665d370be1d49301599aff8fb3e1ffe349f47fd2e6734f844a850a15d08a6
-sha256-linux=86e69337ad1440252a2ee20a12063c989ed12442d3b1ddf9e9233acf0f2ec089
+sha256-darwin=21f2a5484bb10bed1f11bd6397fe80f20d60a870e4ed5016a1f3acbdb4e6f735
+sha256-linux=29fd001e70d0114b59d65dd2a516c1f96a5fea1d6bb8fb315550a27f94d7b39b

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=8d5517f5f2fc32d561782dfccd51b7f746f5e25b2835e37e100c883f7f18777d
+sha256=6b4c126c0b590e5768bcb9928e9bce025ddc2efeddcc8b6cda5ee4855730c469

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=56a9de1c0f000954f1c9ec691e8f24cc2ee387e73cf8b0e684c2baf70317d910
+sha256=d90fa941cb737fe6fcf39ca13d45440183e77a7e047880c025af7e6bfe1d0517

.config/nextest.toml

@@ -454,6 +454,10 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 # until it is explicitly promoted to the fast PR subset — no replication test
 # is ever silently left out of CI.
 #
+# replication_target_matrix_test (the outbound target matrix: every object
+# shape against every remote-target failure mode the fake target models) runs
+# here in full; its expectation table pins known-red cells to open issues.
+#
 # #[serial] does NOT serialize under nextest (process-per-test; see the file
 # header). These tests need no cross-test serialization: each spawns its own
 # server(s) on random ports with isolated temp dirs, so they are parallel-safe
@@ -471,7 +475,7 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 [profile.e2e-repl-nightly]
 default-filter = """
     package(e2e_test)
-    & test(/^replication_extension_test::/)
+    & (test(/^replication_extension_test::/) | test(/^replication_target_matrix_test::/))
     & !test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
 """
 fail-fast = false
@@ -560,6 +564,7 @@ default-filter = """
     & !test(/^protocols::/)
     & !test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|degraded_listing_availability_test|heal_erasure_disk_rebuild_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
     & !test(/^replication_extension_test::/)
+    & !test(/^replication_target_matrix_test::/)
     & !test(/^on_demand_migration::(concurrency_test|fault_test|real_source_test)::/)
 """
 fail-fast = false