[calvin-archastro]

Adds pail obj [--area NAME] ls|get|put|rm (default area actions, objects in <repo>.<area>/), the primitive Tier 2 writers use (docs/actions.md §5).

• ls PREFIX: JSON lines {key,size,version,modified(ms)}, sorted
• get KEY [-o FILE]: exit 3 if absent; with -o prints the version token
• put KEY (FILE|-) [--if-absent | --if-version TOKEN]: prints new token; exit 4 on failed precondition
• rm KEY [--if-version TOKEN]: idempotent; exit 4 on failed precondition
• Token = base64url (no pad) of the store::Version JSON; ls, get -o and put tokens are interchangeable.
• Works on file://, gs://, s3://; http stores refused (as events --cursor bucket:).

Notes:

• Exit 3 is also REFUSED_EXIT for hook refusals; hooks never run in obj, so it is unambiguous within this command.
• rm --if-version is atomic on file://; on buckets it is check-then-delete (no conditional delete in object stores).
• GCS listings omit generations, so ls HEADs each object on gs://.
• Store::cas now maps NotFound on an update to Conflict.
• tests/incremental_tree_is_canonical fails on main already (debug overflow); unrelated.
• Tests: tests/obj.rs on file://, in-process GCS emulator, and PAIL_TEST_STORES (added --test obj to the existing s3/gcs CI jobs).

🤖 Generated with Claude Code