Add S3 access validation script

[chengjianshia]

Motivation

• Provide a tiny CLI tool to validate access to an S3 bucket using credentials supplied via flags, environment variables, or AWS profiles.
• Allow quick verification of both bucket existence/permissions and optional list access under a --prefix.
• Reduce friction when diagnosing AWS credential or configuration problems during development or CI.

Description

• Add executable s3_login.py which implements argument parsing via argparse and credential resolution.
• Create a boto3 Session supporting direct credentials or a profile_name and construct an S3 client.
• Perform head_bucket to validate bucket access and optionally call list_objects_v2 with MaxKeys=1 to test prefix listing.
• Print a clear success message on verification and diagnostic error output on failures, exiting with non-zero on errors.

Testing

• No automated tests were run for this change.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor --profile over ambient credentials

When --profile is supplied, the code still merges in credentials from flags and environment (resolve_credentials), and then passes them alongside profile_name to boto3.Session. In boto3, explicit credential arguments take precedence, so if a user has AWS_ACCESS_KEY_ID/SECRET exported (a common case in CI or local shells), the profile is silently ignored and the access check is performed against the wrong account. This defeats the purpose of --profile and can lead to false positives/negatives when validating bucket access for another profile. Consider omitting env/flag credentials when --profile is set (or explicitly erroring on conflicts).

Useful? React with 👍 / 👎.