fix: pin readTS in resolveAuth and clarify S3_CREDENTIALS_FILE help text

Agent-Logs-Url: https://github.com/bootjp/elastickv/sessions/e9348f84-723b-4073-aea0-e3e35d47f3d4

Co-authored-by: bootjp <1306365+bootjp@users.noreply.github.com>

Author: Copilot

adapter/s3.go

@@ -372,7 +372,11 @@ func (s *S3Server) resolveAuth(r *http.Request, bucket string) *s3AuthError {
 	}
 	// Check if the bucket is public-read and the request is read-only.
 	if isReadOnlyS3Request(r) {
-		meta, _, err := s.loadBucketMetaAt(r.Context(), bucket, s.readTS())
+		readTS := s.readTS()
+		readPin := s.pinReadTS(readTS)
+		defer readPin.Release()
+
+		meta, _, err := s.loadBucketMetaAt(r.Context(), bucket, readTS)
 		if err == nil && isPublicReadBucket(meta) {
 			return nil
 		}

scripts/rolling-update.sh

@@ -35,6 +35,9 @@ Optional environment:
   S3_PORT
   S3_REGION
   S3_CREDENTIALS_FILE
+    Path to an S3 credentials file on each target host. This file must already
+    exist and be readable on every remote node; it will be bind-mounted into
+    the container at the same path.
   S3_PATH_STYLE_ONLY
   HEALTH_TIMEOUT_SECONDS
   LEADERSHIP_TRANSFER_TIMEOUT_SECONDS