feat(storage): add verified offline MinIO migration pilot

scripts/storage/start-seaweedfs.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+# Never start an anonymously writable gateway when its configuration is absent,
+# truncated, or replaced. The host generated and validated this exact file.
+test -n "${FEDEO_S3_CONFIG_SHA256:-}"
+test -s /etc/fedeo/s3.json
+actual_sha256="$(sha256sum /etc/fedeo/s3.json)"
+test "${actual_sha256%% *}" = "$FEDEO_S3_CONFIG_SHA256"
+exec /usr/bin/weed "$@"