s3: ListObjectsV2 fetches every object to compute its md5 ETag #5

s3/ ListObjectsV2 does a GET + full-body buffer for each key in the page (up to S3_MAX_KEYS=1000) to compute the md5 ETag. A single cheap GET /s3/<bucket>?list-type=2 on a bucket of large objects fetches and buffers up to 1000 objects. The crawl itself is capped and cycle-safe; the per-object ETag fetch is the expensive part.

Fix direction: a write-time metadata cache (the api.events.onResourceChange seam — see REPORT.md) would let the ETag be precomputed once per write instead of once per list. Accepted-risk in SECURITY.md.