patches: add v1.11.0 atomic Vault IAM update patch and its leil-rig proof

0004-vault-atomic-update-user.patch makes the Vault IAM backend's
UpdateUserAccount -- what admin update-user, and so every key rotation,
runs -- one KV v2 write with cas set to the version it read, retried
from a fresh read on a check-and-set conflict (up to 5 attempts).
Upstream deleted the entry and created it again: in between, another
instance on the same KV path whose IAM cache missed answered
InvalidAccessKeyId, a failure between the two calls lost the account,
and two updates at once lost one of them. Touches only
auth/iam_vault.go and a new auth/iam_vault_update_test.go.

tests/vault-update/proof.sh proves it on leil-rig against an OpenBao
dev server, with two gateways on one KV path and gateway A's OpenBao
calls held 3 s by a proxy so upstream's gap can be observed. On
leil-test-1: patched 20 passed, 0 failed; 0001-0003 control 13 passed,
7 failed (entry missing 3.00 s, 28 InvalidAccessKeyId on the second
gateway, concurrent rotation lost, account gone after a refused
write). go test on the node: 35 of 35 packages ok.

docs/vault-atomic-update.md has the problem, the change, the proof and
its result; README and the multi-version pipeline doc point at it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/multi-version-pipeline.md

@@ -111,19 +111,23 @@ VGW_REPO_URL="/path/to/local/versitygw" VGW_TAG=vX.Y.Z bash ci/run.sh
 ```
 
 A clean `git am` plus a populated `src/dist/` means the web UI patches
-are good. `0003-owner-scoped-access.patch` changes Go code in `auth/`, so
-a clean apply is not enough for it: run its unit tests in the patched
+are good. `0003-owner-scoped-access.patch` and
+`0004-vault-atomic-update-user.patch` change Go code in `auth/`, so a
+clean apply is not enough for them: run their unit tests in the patched
 tree, on Linux (on Windows several upstream packages fail regardless),
 
 ```bash
 go test ./auth/ ./s3api/...
 ```
 
-and its proof test on leil-rig — see
-[owner-scoped-access.md](owner-scoped-access.md#proving-the-patch-is-in-on-leil-rig).
+and each one's proof test on leil-rig — see
+[owner-scoped-access.md](owner-scoped-access.md#proving-the-patch-is-in-on-leil-rig)
+and
+[vault-atomic-update.md](vault-atomic-update.md#proving-the-patch-is-in-on-leil-rig).
 If upstream has reworked `auth/access-control.go` or `auth/acl.go`,
-re-read that document's rules against the new code rather than only
-resolving the conflict.
+re-read 0003's rules against the new code rather than only resolving
+the conflict; likewise `auth/iam_vault.go` for 0004 — if upstream's
+`UpdateUserAccount` already writes with check-and-set, drop 0004.
 
 `src/` may hold someone's local work tree; `ci/clone-source.sh` deletes
 it. Point `VGW_SRC_DIR` somewhere fresh (any `*-src/` name is