Verify Bucket Access

Read which principals are CURRENTLY on a SKU's bucket policy.

Read-only: never mutates the policy. One SKU maps to one bucket, so a single call verifies every client on that SKU.

Callers use this to answer "does this client actually have access right now", which no CAMS-side record can answer — the grant ledger and the sample settings rows record what we intended, and a lost concurrent write makes the two disagree.

Two outcomes are deliberately 200s with flags rather than HTTP errors, because the caller must render them as "unknown" and a 4xx/5xx invites a silent fallback to intent instead:

• bucket_found=false — the SKU or its bucket is not registered.
• read_ok=false — the live read failed (throttle, access-denied). principal_count is null and present/missing are empty; do NOT read this as "nobody has access".

Defined as sync def on purpose: BucketPolicyManager is fully blocking (boto3 + a sync Postgres handle), so FastAPI runs this in its threadpool rather than stalling the event loop.