build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.96.3 to 1.101.0 in /runtime

[dependabot]

Bumps github.com/aws/aws-sdk-go-v2/service/s3 from 1.96.3 to 1.101.0.

Commits

• 84ddd08 Release 2026-05-06
• 23645b4 Regenerated Clients
• 848eb59 Update API model
• 1d7b134 Release 2026-05-05
• 5bbbc97 Regenerated Clients
• 8dbb936 Update endpoints model
• 369e649 Update API model
• dc2d13f Release 2026-05-04
• da4bcff Regenerated Clients
• a8b1180 Update API model
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[ghost]

LGTM — routine dependency bump, no risk.

Reviewed the full diff and all S3 consumer code in runtime/.

What changed

• aws-sdk-go-v2/service/s3: 1.96.3 → 1.100.0
• aws-sdk-go-v2 core: 1.41.5 → 1.41.6
• smithy-go: 1.24.2 → 1.25.0
• Transitive deps (eventstream, configsources, endpoints, v4a, accept-encoding, checksum, presigned-url, s3shared): patch/minor bumps

What I checked

• runtime/storage.go: Uses PutObject, GetObject, DeleteObject, ListObjectsV2 — all stable S3 APIs, no signature changes in this version range.
• runtime/aws_clients.go:41-48: s3.NewFromConfig with s3.Options — stable constructor, unchanged.
• No code changes: Only go.mod and go.sum touched. Zero behavioral change from this PR.
• Not protocol-critical: This is AWS infra/storage layer, not VTXO/signing/forfeit/round/exit code.
• Cross-repo impact: None. No public API changes.

CI

Checks (lint, unit-test, enclave-test) are pending — wait for green before merge.

🤖 Reviewed by Arkana

[arkana-ai-bot]

Dependency-only bump: aws-sdk-go-v2 1.41.5→1.41.7, service/s3 1.96.3→1.101.0, smithy-go 1.24.2→1.25.1, plus matching transitive deps. Nothing outside runtime/go.mod and runtime/go.sum changed.

• No protocol surface touched (VTXO / signing / forfeit / round / exit paths unaffected).
• Runtime S3 usage is limited to stable v1 APIs — PutObject, GetObject, DeleteObject, ListObjectsV2, ListObjectVersions (see runtime/anchor.go:128,196,229,259, runtime/aws_clients.go:68-94, runtime/acme_cache.go:39,73,88). The S3API interface in runtime/aws_clients.go:68 pins the exact method set the codebase depends on; if any of these signatures had shifted in v1.101.0 the build would break loudly, so cross-repo/consumer impact within enclave is nil.
• No SDK consumers outside enclave — this is a runtime-internal dep.
• Danger passed. CI (unreachable from here — sandbox is offline) should be the gate for the actual go build ./... verification.

Note: PR is >30 days old with dependabot auto-rebase disabled; if merging, confirm CI still passes against current base. Nothing here that requires changes.

[arkana-ai-bot]

This dependabot PR has been open for 9+ days without review. Could someone take a look and merge or close it?