Read bootstrap creds from OpenBao only. Write non-secret attributes after create. Never print keys.
Identity, topology, consumer bindings, and the planned attribute file (region nl-ams, endpoint/bucket still null). Post-purchase fill is REEF-STORAGE-WP-0002.
Declare reef-storage as substrate_kind object-storage. Hold non-secret attribute paths for Scaleway S3. Do not host a compute rail.