* s3: answer NoSuchBucket for encryption and policy writes to a missing bucket
PutBucketEncryption, DeleteBucketEncryption, and PutBucketPolicy surfaced
the filer's bucket-miss as InternalError; GetBucketEncryption masked it as
ServerSideEncryptionConfigurationNotFoundError. Map the miss to
NoSuchBucket instead, matching AWS. Internal readers still treat a missing
bucket as "no encryption configured" so uploads keep their behavior.
* s3: wrap ErrBucketNotFound only for verified misses in bucket policy ops
The filer lookup helpers in get/set/deleteBucketPolicy marked every
LookupDirectoryEntry failure as bucket-not-found, so a transient filer
outage answered NoSuchBucket for a live bucket. Route them through
filer_pb.LookupEntry, which normalizes only true misses to ErrNotFound.
* s3: answer NoSuchBucket when the policy delete's own write loses the bucket
* s3: classify a filer NotFound on the policy UpdateEntry as ErrBucketNotFound
* s3: require the bucket entry to exist on config patch transactions
* s3: answer NoSuchBucket when tagging and CORS writes lose the bucket mid-request
* s3: keep the existence check on no-op bucket config patches
An unchanged config write produced an empty patch that early-returned
before the transaction, so a bucket deleted between the read and the
write still reported success. Ship the condition-only transaction so
IF_EXISTS runs on its own.
* s3: guard the iam step and cover failure-vs-miss classification
Nil-guard s3a.iam in the bucket policy handlers so the handlers do not
panic when no IAM server is wired (unit tests, embedded servers), treat
a "precondition failed" response string the same as the error code when
mapping a failed patch to ErrNotFound, and add handler-level tests that
pin the miss/failure distinction: missing buckets and vanished mid-write
buckets answer 404 NoSuchBucket while transient filer failures stay 500
InternalError.
