fix(s3): prevent compliance retention downgrade

[aniketshukla1]

Summary

• reject attempts to change or remove an active S3 COMPLIANCE retention mode
• preserve the allowed GOVERNANCE-to-COMPLIANCE transition
• add end-to-end coverage for active and expired COMPLIANCE retention transitions

Testing

• JAVA_HOME=/opt/homebrew/opt/openjdk@25/libexec/openjdk.jdk/Contents/Home ./mvnw test -Dtest=S3ObjectLockIntegrationTest (18 tests passed)

Fixes #2598

[github-actions]

🎉 Thanks for your first pull request to Floci!

Your CI checks need a maintainer to approve them before they run. That is GitHub's standard gate on first-time contributors, not a problem with your PR — so if the checks look like they are doing nothing, that is why. Once a maintainer approves, CI and the compatibility suite start automatically. Nothing is needed from you in the meantime.

While you wait, a couple of things that make review faster:

• Link the issue this fixes with Closes #N in the description
• Commits follow Conventional Commits (feat(s3): ..., fix(dynamodb): ...)
• Behaviour changes come with a test — see CONTRIBUTING.md

Come join us in Slack — it is the fastest way to reach maintainers if you get stuck, or want feedback on an approach before investing more time in it.

[greptile-apps]

Greptile Summary

The PR now limits COMPLIANCE retention protections to objects whose retention period is still active, resolving the previously reported expired-retention behavior.

• Prevents active COMPLIANCE retention from being changed or removed.
• Continues to reject shortening an active COMPLIANCE retention period.
• Adds integration coverage for GOVERNANCE-to-COMPLIANCE upgrades, active COMPLIANCE downgrade rejection, persisted modes, and changes after COMPLIANCE expiry.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/s3/S3Service.java	Scopes immutable COMPLIANCE retention checks to unexpired retention periods while preserving mode and date updates after expiry.
src/test/java/io/github/hectorvent/floci/services/s3/S3ObjectLockIntegrationTest.java	Adds end-to-end coverage for allowed upgrades, prohibited active downgrades, persisted retention mode, and expired-retention mode changes.

_{Reviews (2): Last reviewed commit: "fix(s3): allow updates after compliance ..." | Re-trigger Greptile}