patches: add v1.11.0 owner-scoped access patch and its leil-rig proof

0003-owner-scoped-access.patch changes authorization, applied after the
de-brand and dark-theme patches:

- a bucket's ACL and policy may name only the owner's keys (accounts on
  the owner's UserID), whoever writes them, root included;
- public access is read-only: all-users READ, and "*" allowed only
  s3:GetObject and s3:ListBucket;
- the bucket policy never denies the owner's key;
- DeleteBucket, PutBucketVersioning, PutObjectLockConfiguration and
  PutBucketOwnershipControls are reserved to root and admins;
- an ACL with the all-users READ grant can be written back unchanged.

docs/owner-scoped-access.md has the rules, what v1.11.0 already did,
and the leil-rig proof procedure with its 2026-11-10 result: 63 of 63
on the patched build, 29 of 63 failing on stock v1.11.0.
tests/owner-scope/ holds the proof script and a stdlib-only SigV4
request helper. README and the pipeline doc list the patch and how to
re-verify it after a rebase.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/multi-version-pipeline.md

@@ -110,7 +110,24 @@ When upstream releases `vX.Y.Z`:
 VGW_REPO_URL="/path/to/local/versitygw" VGW_TAG=vX.Y.Z bash ci/run.sh
 ```
 
-A clean `git am` plus a populated `src/dist/` means the series is good.
+A clean `git am` plus a populated `src/dist/` means the web UI patches
+are good. `0003-owner-scoped-access.patch` changes Go code in `auth/`, so
+a clean apply is not enough for it: run its unit tests in the patched
+tree, on Linux (on Windows several upstream packages fail regardless),
+
+```bash
+go test ./auth/ ./s3api/...
+```
+
+and its proof test on leil-rig — see
+[owner-scoped-access.md](owner-scoped-access.md#proving-the-patch-is-in-on-leil-rig).
+If upstream has reworked `auth/access-control.go` or `auth/acl.go`,
+re-read that document's rules against the new code rather than only
+resolving the conflict.
+
+`src/` may hold someone's local work tree; `ci/clone-source.sh` deletes
+it. Point `VGW_SRC_DIR` somewhere fresh (any `*-src/` name is
+gitignored) when in doubt.
 
 ## Retiring a version