[fil-forge-bot]

Sets every prod pin in terraform/envs/prod/apps/terraform.tfvars
to what terraform/envs/staging/apps/terraform.tfvars pins at 6cdeb78.
Merging this is the promotion: Check and deploy applies terraform/envs/prod/apps
on the merge commit, with no further confirmation.

staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38589211473.

This pull request is rebuilt each time staging passes its smoke test after a push
to main, and closed once prod matches staging. To hold a service back, push
to bot/promote-prod by hand: the bot leaves the branch alone while this pull
request is open.

hilt

sha256:80076f3 → sha256:5b6d022

What fil-forge/hilt brings over prod's pin, a026d16..42dd070:

• feat(s3perm): add the policy vocabulary (feat(s3perm): add the policy vocabulary hilt#58) (89d4ccf)
• feat(store): add the principal store and share-locked reads (feat(store): add the principal store and share-locked reads hilt#59) (434839e)
• feat(bucketpolicy): add the bucket policy and its evaluation (feat(bucketpolicy): add the bucket policy and its evaluation hilt#60) (b30465e)
• feat(store): add the bucket policy store with compare-and-set writes (feat(store): add the bucket policy store with compare-and-set writes hilt#61) (1ff52cb)
• fix(store): bound every Postgres lock wait (fix(store): bound every Postgres lock wait hilt#84) (98d7a12)
• feat(api): bind access keys to principals (feat(api): bind access keys to principals hilt#64) (894624d)
• feat(grant): rotate and revoke principal-bound key delegations (feat(grant): rotate and revoke principal-bound key delegations hilt#65) (e372bcd)
• feat(api): add principals and principal-bound access keys (feat(api): add principals and principal-bound access keys hilt#66) (880f780)
• feat(api): add bucket policies and the principal access reads (feat(api): add bucket policies and the principal access reads hilt#67) (f366100)
• feat(rpc): authorize principal-bound keys against bucket policies (feat(rpc): authorize principal-bound keys against bucket policies hilt#68) (9e93a34)
• feat(rpc): answer /s3/bucket/info for a principal-bound key (feat(rpc): answer /s3/bucket/info for a principal-bound key hilt#85) (b7ed334)
• test(itest): cover the IAM model end to end and document it (test(itest): cover the IAM model end to end and document it hilt#69) (fa1512f)
• feat(api): revoke every key's delegations before removing a tenant (feat(api): revoke every key's delegations before removing a tenant hilt#80) (70f9380)
• feat(rpc): read and write bucket policies over /s3/bucket/policy (feat(rpc): read and write bucket policies over /s3/bucket/policy hilt#89) (6a675f4)
• feat(bucketpolicy): make the bucket policy an AWS bucket policy document (feat(bucketpolicy): make the bucket policy an AWS bucket policy document hilt#96) (42dd070)