Align the MAS IAM rule and read num_uses from the raw writer response.

Adds the one-session Scaleway IAM grant script, merges the publisher
bucket probes into one statement to fit the 10-statement limit, keeps
the Playwright cache under the account home during attended login, and
records the publisher-gate runs through the num_uses rejection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 49552@bnt-lap001
Assistant-Session: 575802ee-c0c0-42a9-b2a1-9204c9f5b3f4

tests/test_operator_browser.py

@@ -26,6 +26,12 @@ class BrowserBoundary(unittest.TestCase):
         joined=' '.join(argv)
         for banned in ('explorer.exe', 'powershell', 'msedge', 'firefox', '/mnt/c/'):
             self.assertNotIn(banned, joined)
+    def test_contained_home_does_not_move_the_browser_cache(self):
+        self.assertEqual(
+            launcher["playwright_cache"]("/tmp/warden-session", "/home/operator"),
+            Path("/home/operator/.cache/ms-playwright"),
+        )
+
     def test_chromium_comes_from_the_playwright_pin(self):
         import json
         import tempfile