feat: compose exact bounded resource identities

[shaggitza]

Summary

• add schema-v4 ordered composite resource selectors with strict finite bounds
• domain-separate each selector component and fail closed on unavailable or oversized products
• identify typed S3 object operations by exact (Bucket, Key) rather than Key alone

Validation

• 61 focused model/audit/preset tests passed
• direct same/different/dynamic composite coupling cases passed
• exact S3 owner, wrong-owner, order, missing-component, and 8/9-boundary probes passed
• independent tranche adjudication: PASS, no blockers

Partial progress on #282. Keep the issue open for endpoint-local helper correlation, deferred-scope and alias confidence, built-in-copy provenance, and broader preset evidence.