Require a real-S3 round-trip integration test

Forest's unit and integration tests use rclone's local-directory backend, which cannot exercise S3 authentication, region resolution, or s3:// URL construction. A real-S3 round-trip test is therefore a required pre-release gate: it pushes and pulls a tiny file through a real bucket and verifies the transferred content byte-for-byte.

The test (tests/test_s3_integration.py) is opt-in via FOREST_TEST_S3_PROFILE, so it skips for contributors without credentials and in CI until credentials are wired in. The bucket and region default to the shared reference bucket forest-cli-test in us-east-2; override with FOREST_TEST_S3_BUCKET / FOREST_TEST_S3_REGION to use your own. The bucket name must contain test (the fixture refuses anything else — purge safety), and AWS profile names stay out of the repo. Each run writes under a unique pytest/<uuid>/ prefix and purges it on teardown, so runs never collide and the bucket is left clean.

Consequences

• Releasing forest requires this test to pass locally against the real bucket; the checkout feature's push/pull/status/ls must be covered by it too.
• To gate in CI, provide the profile's credentials (OIDC role or secrets) and set the three env vars; otherwise CI skips it.
• The local-dir rclone backend remains the default for fast, offline tests; S3 is the pre-release confidence check.