security: implement group 2 - storage security hardening

[rshade]

Storage Security Hardening (HIGH PRIORITY)

Reference: security-groups/group-2-storage-security.md

Tasks

1. CMEK encryption for all 3 GCS buckets (checkpoint, policy, ESC)
2. Object versioning on checkpoint and policy buckets
3. Access logging — enable storage access logs for compliance
4. Lifecycle policies — cost optimization with NEARLINE/archive transitions
5. Uniform bucket-level access — consistent IAM enforcement

Acceptance Criteria

• All buckets encrypted with customer-managed keys
• Object versioning enabled
• Access logging configured and generating logs
• Lifecycle policies applied
• Uniform bucket-level access enabled
• Application functionality unchanged