docs: record EC2 storage and tag action adapter moves

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -275,6 +275,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `05f390e61` | `cmd/spinifex/cmd` | `spinifex/operator/cli` | The `spx` command tree is operator CLI assembly; package `cmd` becomes `cli` and `cmd/spinifex/main.go` stays the thin entry point calling `cli.Execute()`. The `-X` version and commit ldflags in the Makefile and `build/Dockerfile.distro` follow the new import path, and a build using the Makefile `LDFLAGS` printed the injected version rather than `dev`. Template paths in `scripts/reset-dev-env.sh`, `migrate/VERSIONS.md` and the NATS role test follow the move. The listener-bind invariant globbed the old template path, found nothing and passed without examining any template; it now uses the new path and fails when the glob is empty, confirmed against the old path. Moving out of `cmd/` brought the tree under errcheck and gosec (105 findings uncapped). Config and flag wiring now goes through unexported `mustBindEnv`, `mustBindPFlag` and `mustMarkFlagRequired` helpers that panic with the config key, flag and command at startup instead of silently dropping a binding; all 110 sites are covered by the package's init and existing bind-function tests. Listing tables are written with `Srender` and a checked write because pterm's `Render` discards write errors; output is byte-identical and writing to a full device now exits 1. The formation-server shutdown discards are explicit, the `http.DefaultTransport` assertion is checked, twelve permission findings are annotated per line, and the formation join's `InsecureSkipVerify` is annotated as a known security gap (see dependency-rule debt). Full preflight apart from the known vulnerability-scan finding passed. |
 | `5032e24a7`, `d500e3802`, `e630703d7`, `eb68ec460`, `ebcafa01f` | `gateway/ec2/{account,capacityreservation,key,launchtemplate,placementgroup}` | `spinifex/domains/ec2/awsapi/<same>` | EC2 action adapters are domain-owned AWS API surface, so they move under the EC2 domain's `awsapi`, one commit per resource. Each package takes its directory name and callers use `ec2<resource>api`; moved files change only their package line. `gateway/ec2.go` keeps the dispatch map unchanged as the transitional registration point. Callers are the gateway dispatch and account teardown's EC2 reapers. Adapter, gateway dispatch and account-teardown tests, the integration and E2E builds, and full preflight passed. |
 | `c38bf99e4`, `2ee60b20f`, `eaa5c971e`, `f6d8060f2`, `f50687210`, `817e19bf2`, `67992c8f5` | `gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/awsapi/<same>` | The VPC-networking action adapters follow the same per-resource pattern; `zone` moves first because the instance adapter depends on it. Moved files change only their package line (`vpc_test` for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed. |
+| `4b315469f`, `8b106e796`, `7ee808d2d`, `0485c77e6` | `gateway/ec2/{image,snapshot,volume,tags}` | `spinifex/domains/ec2/awsapi/<same>` | Image, snapshot, volume and tag action adapters follow the same per-resource pattern; moved files change only their package line. Callers are the gateway dispatch, account teardown's EC2 reapers and the quota storage counter. The volume adapter still imports the instance adapter, which moves next. Adapter, gateway, account-teardown and quota tests, the integration and E2E builds, and full preflight passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -362,7 +363,7 @@ These residuals were recorded by individual slices and must be resolved once the
 - `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks,quota}`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `admin`, `accountteardown`, `migrate`, `services/viperblockd` and runtime roles). ADR row 231 requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
 - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
 - `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. ADR row 225 replaces this with domain-owned cleanup capabilities before the package moves.
-- `handlers/quota` (dependency): the live quota counters call `domains/ec2/awsapi/{vpc,eip}` describe adapters to count VPCs, subnets and addresses, as they did under `gateway/ec2`. ADR row 254 replaces these with reader capabilities once their final locations exist.
+- `handlers/quota` (dependency): the live quota counters call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. ADR row 254 replaces these with reader capabilities once their final locations exist.
 - Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated.
 
 ## Recording rule