P6: S3 blob store, Helm chart, air-gapped installer verify loop

- S3BlobStore (object_store, path-style) behind the same BlobStore trait,
  tested against a REAL MinIO container (round trip, overwrite, NotFound
  on get and delete, nested keys); [storage] backend=local|s3 config with
  validation + server-side selection (S3 creds via env overlay)
- Helm chart: server pod with the secret broker as a SIDECAR sharing a
  private emptyDir unix socket (no network hop carries credentials),
  frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE
  ingress annotations, NetworkPolicies (frontend->server only), hardened
  securityContexts; ci/check-helm.sh lints AND asserts the rendered
  topology properties
- deploy/airgapped/install.sh: offline signature+checksum verification via
  the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode;
  ci/test-install.sh rehearses clean/tampered/wrong-key paths with the
  real binary
- CI: helm gate + installer rehearsal wired in

149 Rust tests; helm lint + rendered assertions green; installer
verify-path rehearsal green.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-config/src/lib.rs

@@ -67,16 +67,39 @@ pub struct AuthConfig {
     pub client_id: Option<String>,
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum StorageBackend {
+    Local,
+    S3,
+}
+
 #[derive(Debug, Clone, Deserialize)]
 pub struct StorageConfig {
     /// Root directory for file-drive blobs (volume-mounted in compose).
     pub data_dir: String,
+    #[serde(default = "default_backend")]
+    pub backend: StorageBackend,
+    /// S3 backend settings; keys arrive via TEAMCLAW_STORAGE__* env vars.
+    pub s3_endpoint: Option<String>,
+    pub s3_bucket: Option<String>,
+    pub s3_access_key: Option<String>,
+    pub s3_secret_key: Option<String>,
+}
+
+fn default_backend() -> StorageBackend {
+    StorageBackend::Local
 }
 
 impl Default for StorageConfig {
     fn default() -> Self {
         StorageConfig {
             data_dir: "./data".into(),
+            backend: StorageBackend::Local,
+            s3_endpoint: None,
+            s3_bucket: None,
+            s3_access_key: None,
+            s3_secret_key: None,
         }
     }
 }
@@ -177,6 +200,14 @@ impl AppConfig {
             }
             _ => {}
         }
+        if self.storage.backend == StorageBackend::S3
+            && (self.storage.s3_endpoint.is_none() || self.storage.s3_bucket.is_none())
+        {
+            return Err(ConfigError::Invalid(
+                "storage.backend = \"s3\" requires storage.s3_endpoint and storage.s3_bucket"
+                    .into(),
+            ));
+        }
         if self.auth.mode == AuthMode::Oidc {
             if self.auth.issuer_url.is_none() {
                 return Err(ConfigError::Invalid(

crates/tc-config/tests/config.rs

@@ -139,3 +139,15 @@ fn missing_file_is_a_clear_error() {
         Ok(())
     });
 }
+
+#[test]
+fn s3_backend_requires_endpoint_and_bucket() {
+    figment::Jail::expect_with(|jail| {
+        let toml =
+            format!("{AIR_GAPPED_TOML}\n[storage]\ndata_dir = \"./data\"\nbackend = \"s3\"\n");
+        jail.create_file("teamclaw.toml", &toml)?;
+        let err = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap_err();
+        assert!(matches!(err, ConfigError::Invalid(msg) if msg.contains("s3_endpoint")));
+        Ok(())
+    });
+}