fix: harden CLI safety, S3 transport, and release workflows

[overtrue]

Summary

This came out of a repo-wide adversarial review rather than a single issue.

Related issue: none.

• harden downloads, destructive operations, pagination, mirror concurrency, and terminal output
• stream large reads where possible and apply retry, timeout, TLS, and redirect settings consistently
• remove silent integration-test skips and tighten dependency, CI, Docker, and release checks

Breaking changes

BREAKING: unsupported command options now return an explicit error instead of being silently ignored. Bucket and prefix removal also requires --recursive, and SigV2 alias configuration is rejected because the transport only supports SigV4.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked --quiet
• cargo test --package rustfs-cli --test golden --features golden --locked
• cargo deny check advisories
• RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps --locked
• cargo +1.92.0 check --workspace --all-targets --locked

Protected schema, config, exit-code, and command-reference files are unchanged. Full external S3 and Docker runtime coverage remains in CI.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.