Bug fixes

• The AWS > S3 > Bucket > CMDB control could enter an error state with the unhelpful reason UnknownError when Guardrails was not allowed to read a bucket — for example, when a restrictive bucket policy limits access to specific roles. This also prevented the Enforce: Enabled but ignore permission errors policy value from doing its job of tolerating such buckets. This has been resolved; the control now recognizes the permission error and reports a clear Insufficient permissions for HeadBucket operation reason, and with Enforce: Enabled but ignore permission errors set it keeps the bucket in an ok state and records the missing permissions in the resource metadata. Affected controls recover automatically on their next run after upgrading — no cleanup is required.