fix(infra): boot-diag empty-bucket guidance and boot.log selection

[flipvh]

Adopts raak's boot-diag improvements upstream (cellajs/raak#125, merged there), from a production incident where every deploy failed at cutover and pnpm --filter infra diag gave no useful signal.

What

• Empty boot-diag prefix explains instead of aborting. aws s3 ls on a zero-object prefix exits 1 with no stdout and no stderr; createAwsReader.list() treated that as a fatal listing failure. New isEmptyPrefixLs() classifies it (exit 1 + empty stdout + empty stderr only, so AccessDenied / bad endpoint / bad bucket still abort), list() returns '' for it, and emptyBootDiagGuidance() prints the two known causes: the boot runner never ran (check serial console for ::<slug>:: markers and "BOOT FAILED"), or uploads are denied because the boot principal predates the IAM v2 model (Scaleway does not honor bucket-policy-only grants). Every boot uploads a transcript, success or failure (boot.ts finally), so an empty prefix is a finding, not an error.
• selectDiagnostics picks the actual transcript. The sibling <svc>-<stamp>-events.jsonl sorts after <svc>-<stamp>-boot.log, so .at(-1) returned raw OTLP records instead of the readable transcript. latestFull is now pinned to -boot.log keys.
• renderDiagnostics prints a single "nothing was ever uploaded" line when a service owns zero objects, instead of misleading per-section noise.
• diag.ts threads appConfig.slug into the guidance and prints it when parseKeys yields nothing (except under --replay).

Delta from the raak original

raak's guidance pointed at the infra CLI "Migrate IAM model" flow, which no longer exists: the IAM migration machinery was deleted in #1024 (IAM v2 only). The guidance (and its test) now points at the "Stack setup" apply, which is what provisions the current boot principal (ObjectStorageObjectsWrite via BOOT_PROJECT_PERMISSION_SETS).

Not adopted: raak's cella/migrations/manifest.json roots tweak for 20260730T0858-frontend-module-placements. That migration precedes 20260730T1258-cella-config-into-cella-folder in replay order, so cella.config.ts is still at the repo root at that point in the sequence; the existing value is correct.

Verification

• pnpm --filter infra exec vitest run: 78 files, 665 passed (includes new coverage for isEmptyPrefixLs, empty-prefix listing, boot.log-over-events selection, and the single no-diagnostics line)
• pnpm check: clean
• Not sync-breaking, no migration needed; behavior-only improvement to a diagnostic tool. raak converges on its next pnpm cella sync. projectcampus's copies are byte-identical to current main, so it inherits conflict-free.

🤖 Generated with Claude Code