* s3vectors: reject empty boolean-operator lists and sub-objects in filters
An empty $and/$or list or a nested empty object rendered '()'' — invalid
SQL surfaced as an engine error instead of a clean ValidationException.
* s3vectors: e2e conformance for vector bucket policy evaluation
The handler-level test covers statements; this runs the whole stack a
client sees — HTTP dispatch, authentication, policy evaluation, catalog,
engine — and walks the full lifecycle: a non-owner is denied without a
grant, an Allow on the bucket ARN grants every index under it, a Deny
vetoes an Allow on the same action, and deleting the policy restores
owner-only access.
* s3vectors: prove deny precedence and grant removal in policy e2e
* s3vectors: reject field operator objects with no operators
* test: use an s3vectors action in the vector policy round-trip