Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/atlas/fleet_gossip_test.go

@@ -2,15 +2,12 @@ package atlas
 
 import "testing"
 
-func TestNormalizeFleetGossipRecords(t *testing.T) {
-	in := []FleetGossipRecord{
-		{Kind: FleetGossipHaveShard, AgentID: "a", Token: "tok", ShardHash: "abc"},
-		{Kind: "bogus"},
-		{Kind: FleetGossipHealthy, AgentID: "b", Healthy: true},
-		{Kind: FleetGossipKnowNode, AgentID: "a", TargetAgentID: "c"},
-	}
-	out := NormalizeFleetGossipRecords(in)
-	if len(out) != 3 {
-		t.Fatalf("got %d records", len(out))
+func TestNormalizeFleetGossipShardAdvert(t *testing.T) {
+	r, ok := NormalizeFleetGossipRecord(FleetGossipRecord{
+		Kind: FleetGossipHaveShard, AgentID: "a", Token: "t", ShardHash: "h",
+		Region: "us-west-2", ShardIndex: 4,
+	})
+	if !ok || r.ShardAdvert != "us-west-2:4" {
+		t.Fatalf("advert=%q", r.ShardAdvert)
 	}
 }