B2 Hygiene

Audit a scanned Backblaze B2 account for hidden-version retention gaps, over-scoped or orphaned application keys, and public buckets. Read-only — it analyses the resources b2-account's scan already wrote and never calls B2.

First release. Read-only fleet audit over a b2-account scan: hidden-version retention gaps, account-wide and orphaned application keys, dangerous key capabilities, and public buckets. Never calls B2. A truncated inventory is never presented as a clean account, and an unparseable lifecycle rule is reported as 'cannot tell' rather than as a missing rule.