fix(backup): 归档校验改用 ListObjects 避免依赖对象 HeadObject 权限

scripts/archive-binlog.sh

@@ -204,9 +204,9 @@ verify() {
   while IFS= read -r -d '' state_file; do
     remote_dir="$(awk -F= '$1 == "remote_dir" { print substr($0, index($0, "=") + 1); exit }' "${state_file}")"
     [[ -n "${remote_dir}" ]] || { backup_error "归档状态不完整：${state_file}"; exit 1; }
-    ossutil stat "${remote_dir}/binlog.enc" >/dev/null
-    ossutil stat "${remote_dir}/binlog.enc.sha256" >/dev/null
-    ossutil stat "${remote_dir}/complete.env" >/dev/null
+    backup_oss_object_exists "${remote_dir}/binlog.enc" || { backup_error "远端对象缺失：${remote_dir}/binlog.enc"; exit 1; }
+    backup_oss_object_exists "${remote_dir}/binlog.enc.sha256" || { backup_error "远端对象缺失：${remote_dir}/binlog.enc.sha256"; exit 1; }
+    backup_oss_object_exists "${remote_dir}/complete.env" || { backup_error "远端对象缺失：${remote_dir}/complete.env"; exit 1; }
   done < <(find "${state_dir}" -maxdepth 1 -name '*.state' -print0)
   backup_log '全部本地 binlog 归档状态均有远端完整对象'
 }

scripts/backup-common.sh

@@ -181,6 +181,12 @@ backup_oss_download() {
   ossutil cp "${source}" "${destination}"
 }
 
+# 用 ListObjects 校验远端对象存在，避免依赖对象 HeadObject 权限（oss:GetObjectMeta）。
+backup_oss_object_exists() {
+  local key="$1"
+  ossutil ls "${key}" 2>/dev/null | grep -q 'Object Number is: 1'
+}
+
 backup_write_complete_marker() {
   local path="$1"
   local payload_name="$2"