fix: close the four recorded coverage defects

[skyoo2003]

Summary

Closes the three defects #144 recorded and did not fix, plus the two xfail(strict) leftovers #145 pinned. Every exception the coverage claim carried is now removed rather than documented: UNREACHABLE_FROM_BOTO3 and KNOWN_UNFIXED are both empty, and no xfail remains in the compatibility suite.

No service is added. Registered stays 205; compatibility-tested rises 199 → 203.

Related Issue

Refs #144, #145

Changes

Two of the recorded defects were not what their reports said, and measuring before implementing is what caught it.

• The four Lex services were reachable by no boto3 caller. All four clients sign as lex, no service is called lex, so the alias stays contested and every call died as UnknownService. The report said this needed a four-way path split; it needed a map lookup. resolveSharedSigningName already picks the sibling whose route table models the request — signingNameOf only recognised a member service ID, and lex is the group's key. The four route tables separate on method and literal segment (GET /bots → lex-models, POST /bots → lexv2-models, /bot/…/session → lex-runtime, /bots/…/botAliases/… → lexv2-runtime). Exactly one operation collides — DeleteBot at DELETE /bots/{id} — and it stays refused, because deleting the wrong bot is worse than an honest error.

• Three operations labelled hand-verified were reached by no route. appsync/ListApis, eks/ListAccessPolicies and opensearch/ListApplications are each implemented by a case clause; codegen reads that clause, which proves the code exists, not that a request arrives at it. Their hand-written path resolvers did not know the route boto3 sends. crud.Route (HasRoute's implementation, exported) is now the fall-through, recovering the operation from the service's own model. It fires only where the resolver produced nothing, so it fills gaps and cannot displace a decision a provider made.

• resourcegroups.Tag was never a fabricated success. opNamePattern requires four characters, so Untag was scanned and Tag — implemented beside it in the same switch — was dropped, and the manifest reported implemented code as unimplemented. The 200 was real code answering; the probe believed the manifest and the report inherited the error. Relaxing the regex to two characters would admit the GET/PUT literals every path resolver switches on, fleet-wide, to fix one operation — a census found exactly one operation short enough to be affected. Short literals are now promoted only where the service's model declares them.

• S3 answered an unimplemented bucket sub-resource with a bucket listing. GET /{Bucket}?analytics matched no sub-resource branch and fell through to listObjects, so botocore read the 200 <ListBucketResult> as a successful ListBucketAnalyticsConfigurations. The report named one sub-resource; the fall-through covered eight (?inventory, ?metrics, ?replication, ?lifecycle, ?encryption, ?versions, ?object-lock). The guard is an allow-list of the parameters a listing carries, not a deny-list of sub-resource names: a missing allow-list entry declines a real listing and a test says so at once, while a missing deny-list entry serves a sub-resource as a listing, silently — which is the defect.

• Docs republished by the gate, not by hand. TestPublishedOperationTiersMatchTheManifest and the Python figure gate both fired and had to be satisfied: compatibility-tested 199 → 203, hand-verified 4,496 → 4,497, unimplemented 2,718 → 2,717. The stale claim that each Lex service is "reached by its own unambiguous name" is corrected — no boto3 caller has one.

Test Plan

Every fix has a reproducer that failed first. RED output is quoted in each commit message.

CGO_ENABLED=0 go test ./...                             → all pass
CGO_ENABLED=0 go build -o dist/devcloud ./cmd/devcloud  → ok
make codegen; git status --porcelain internal/generated → clean
bash scripts/generate-imports.sh; git diff --exit-code  → clean
golangci-lint run                                       → 0 issues
DEVCLOUD_BIN=dist/devcloud pytest tests/compatibility/  → 1127 passed, 17 skipped, 0 xfailed

The suite grew 1,119 → 1,127: four Lex services joined the floor parametrisation, three reachability probes were added, one xfail became a pass, and one probe stopped being offered because its operation is now correctly labelled served.

New tests:

• internal/gateway/protocol_test.go:TestDetectProtocol_Lex — 11 cases including the collision that must stay refused
• tests/compatibility/test_handverified_is_reachable.py — 3 operations, asserted individually because the per-service floor test tolerates a single overstated operation
• internal/codegen/gen_fidelity_test.go:TestBuildFidelityDataPromotesShortDeclaredOperations — and that a short literal no model declares never becomes an operation
• internal/codegen/scan_handverified_test.go:TestScanProvidersCollectsShortLiteralsSeparately
• internal/services/s3/provider_test.go:TestS3Provider_UnhandledBucketSubresourceDeclines — 8 sub-resources decline, 7 real listing shapes still serve

test_lex_services_are_unreachable_from_boto3 is deleted, as its own docstring instructed whoever fixed the routing to do, and replaced by a check on the direction that still matters.

Not in this PR, recorded rather than folded in

• 27 other providers hand-roll the same kind of path resolver. Whether any has the same gap is not measured: the fleet-wide version of the reachability test needs the operation tier in internal/generated/compat/services.json, which currently carries only servedOps. That is a codegen change and its own piece of work.
• appsync, eks, opensearch and resourcegroups answer NotImplemented rather than returning plugin.ErrUnhandledOp, so the CRUD engine is never reached for anything they do not name — the same class as the eight query providers in fix: eight query providers fabricated a success for unimplemented actions #145. It re-tiers hundreds of operations and moves the published figures, so it deserves the same standalone treatment. A fleet-wide count of providers with this shape should come first: fix: eight query providers fabricated a success for unimplemented actions #145 found eight where the report named one.

Checklist

• Self-reviewed the code
• Added/updated tests
• Lint/format passes (golangci-lint run)
• Updated documentation (docs/coverage.md)
• Added a Changie changelog fragment for user-facing changes (4 Fixed entries)