seed: planned Scaleway backup store for WP-0002

Identity, topology, consumer bindings, and the planned attribute file
(region nl-ams, endpoint/bucket still null). Post-purchase fill is
REEF-STORAGE-WP-0002.

docs/post-purchase-seed.md

@@ -0,0 +1,25 @@
+# Fill reef-storage after Scaleway purchase
+
+Run only after human financial authority approves
+`resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`.
+
+1. Create a Scaleway project on the Railiance (or GmbH) paying account.
+2. Create a **private** bucket in `nl-ams`, Standard Multi-AZ.
+3. Enable versioning. Set lifecycle to the 30-day recovery window.
+4. Create a key that can only list/get/put/delete on that bucket/prefix.
+5. Turn on a project cost alert.
+6. Write the non-secret facts into
+   `substrate/object-stores/platform-audit-storage.yaml`:
+   `endpoint`, `bucket`, `prefix`, `provider_project_ref`, `versioning`,
+   `lifecycle`. Status → `active`.
+7. Append the bucket/project to `declarations/reef.yaml` `current_members`
+   and `substrate/topology.yaml` `members`. Reef `lifecycle_state` may stay
+   `planned` until the first restore (T05), or become `active` when the
+   bucket exists — prefer `active` only after T05.
+8. Hand `secret:railiance-platform/platform-pg-backup-s3` to OpenBao (T04).
+   Do not commit the key.
+9. Tell resource-control: set inventory `decision.status: approved`,
+   `status: ordered`, `ordered_on`, `provider.provider_resource_id`.
+
+Do not paste endpoint or keys into chat as the source of truth. The YAML
+file is the source for `reef:storage/…` references.