Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/policy-import-validation_test.go

@@ -0,0 +1,47 @@
+// Copyright (c) 2026 PGSTY
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestIAMImportRejectsUnknownPolicyFields(t *testing.T) {
+	_, _ = iamAdminFixture(t)
+	for _, raw := range []string{
+		`{"Version":"2012-10-17","Statements":[]}`,
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::b/*"],"Conditions":{"StringEquals":{"s3:ExistingObjectTag/classification":"public"}}}]}`,
+	} {
+		data := iamImportArchive(t, map[string]any{allPoliciesFile: map[string]json.RawMessage{"import-policy": json.RawMessage(raw)}})
+		req, err := newTestSignedRequestV4(http.MethodPut, "http://localhost/minio/admin/v3/import-iam-v2", int64(len(data)), bytes.NewReader(data), globalActiveCred.AccessKey, globalActiveCred.SecretKey, nil)
+		mustIAM(t, err)
+		mustIAM(t, req.ParseForm())
+		rec := httptest.NewRecorder()
+		adminAPIHandlers{}.ImportIAMV2(rec, req.WithContext(newContext(req, rec, "ImportIAM")))
+		if rec.Code != http.StatusBadRequest {
+			t.Fatalf("import malformed policy: got %d %s, want 400", rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func TestSessionPolicyWriteKeepsStrictSemanticValidation(t *testing.T) {
+	raw := []byte(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["admin:GetBucketQuota"],"Resource":["arn:aws:s3:::mybucket"],"NotResource":["arn:aws:s3:::otherbucket"]}]}`)
+	if _, err := parseSessionPolicyStrictBytes(raw); err == nil {
+		t.Fatal("new session policy accepted conflicting Resource and NotResource")
+	}
+	if _, err := parsePolicySnapshotBytes(raw); err != nil {
+		t.Fatalf("historical snapshot compatibility lost: %v", err)
+	}
+}
+
+func TestBucketPolicyRejectsUnsupportedNotPrincipal(t *testing.T) {
+	raw := []byte(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","NotPrincipal":{"AWS":"excluded-user"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}]}`)
+	if _, err := parseBucketPolicyStrictBytes(raw, "b"); err == nil {
+		t.Fatal("unsupported NotPrincipal was silently discarded")
+	}
+}