backblaze-b2-rclone-backuplisted

## Object Lock retention does NOT auto-apply from the bucket's default policy Setting a bucket's `defaultRetention` (via `b2_update_bucket`, `fileLockEnabled: true` + `defaultRetention: {mode: "governance", period: {...}}`) does **not** cause objects uploaded via rclone's S3-compatible backend to actually inherit that retention. Confirmed live: objects uploaded with no explicit lock flags could be deleted immediately afterward by the same credential that uploaded them, despite the bucket showing a correctly-configured default retention policy. rclone requires the retention to be requested **explicitly on every upload**, via two flags that only take effect together: ```bash RETAIN_UNTIL=$(date -u -d '+35 days' +%Y-%m-%dT%H:%M:%SZ) rclone sync SOURCE b2:bucket --s3-no-check-bucket \ --s3-object-lock-mode=GOVERNANCE \ --s3-object-lock-retain-until-date="$RETAIN_UNTIL" ``` Per rclone's own backend docs (`rclone help backend s3`): "To enable Object Lock retention, you must set BOTH `object_lock_mode` AND `object_lock_retain_until_date`. Setting only one has no effect." `--s3-object-lock-retain-until-date` needs a computed absolute date (moving target each run, not a fixed value) — compute it fresh in the wrapper script every invocation. **Verifying retention actually took, without risking real data**: don't just check the bucket setting or trust a clean upload exit code. Upload a throwaway object, then attempt to delete it with the *same* scoped credential the sync job us