fix(iam): isolate policy reloads and propagate KMS cancellation

Release the authentication-cache lock while retaining IAM write ordering. Carry request cancellation through IAM and SSE-S3 list decryption, and publish policy replacements only after a complete successful load.

Preserve caller deadlines for slow policy queries and keep the existing etcd read budget scoped to its RPC. Cover concurrent refresh, updates, revocation, cancellation, and deadline compatibility.

Validation: 36 focused and 23 adversarial scenarios each passed three race runs; real 32-second object/etcd probes passed. Full suite passed with the Go DNS resolver after reproducing native DNS failures on the baseline; existing etcd suites, make verifiers, and make build also passed.
Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/iam-store.go

@@ -1581,10 +1581,22 @@ func (store *IAMStoreSys) ListPolicies(ctx context.Context, bucketName string) (
 	defer store.unlock()
 
 	m := map[string]PolicyDoc{}
-	err := store.loadPolicyDocs(ctx, m)
+	// Keep cache writers serialized, but let authentication use the committed
+	// cache while the replacement is loaded into this private map.
+	err := func() error {
+		store.IAMStorageAPI.unlock()
+		defer store.IAMStorageAPI.lock()
+		if err := store.loadPolicyDocs(ctx, m); err != nil {
+			return err
+		}
+		return ctx.Err()
+	}()
 	if err != nil {
 		return nil, err
 	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
 
 	// Sets default canned policies
 	setDefaultCannedPolicies(m)
@@ -1609,10 +1621,20 @@ func (store *IAMStoreSys) ListPolicyDocs(ctx context.Context, bucketName string)
 	defer store.unlock()
 
 	m := map[string]PolicyDoc{}
-	err := store.loadPolicyDocs(ctx, m)
+	err := func() error {
+		store.IAMStorageAPI.unlock()
+		defer store.IAMStorageAPI.lock()
+		if err := store.loadPolicyDocs(ctx, m); err != nil {
+			return err
+		}
+		return ctx.Err()
+	}()
 	if err != nil {
 		return nil, err
 	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
 
 	// Sets default canned policies
 	setDefaultCannedPolicies(m)