Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/bucket-metadata-replication.go

@@ -182,8 +182,13 @@ func bucketConfigPayload(bucket, file string, data []byte, lockEnabled bool) ([]
 	key := data
 	switch file {
 	case bucketPolicyConfig:
+		// Replication uses explicit null as a tombstone; ordinary policy PUTs
+		// validate their JSON before entering this metadata path.
+		if bytes.Equal(bytes.TrimSpace(data), []byte("null")) {
+			return nil, nil, nil
+		}
 		var cfg *policy.BucketPolicy
-		cfg, err = policy.ParseBucketPolicyConfig(bytes.NewReader(data), bucket)
+		cfg, err = parseBucketPolicyStrictBytes(data, bucket)
 		if err == nil {
 			if cfg.IsEmpty() {
 				return nil, nil, nil