Handle becomes secret:railiance-platform/backup. IAM application is resource-control; policy and API key are Scoped backup access.
Policy now allows Object Storage. Inventory moves proposed -> ordered with provider_resource_id and reef-storage attribute refs. Cost alert remains a founder console action; scoped Barman key is T04.