[miki3421]

Private Filer IAM verification currently collapses transport errors, HTTP failures, invalid JSON/schema and incorrect anonymous grants into one generic exception. Add fixed phase/category fields and a validated HTTP status so operators can distinguish these causes without exposing response bodies, credentials, bucket names or IAM documents.

The exact persisted-grant check still fails closed. Reconciliation/ingress ordering and the readiness/retry behavior from #162 are preserved. This is a diagnostic follow-up related to apache/openserverless#286.

Validation:

• All 167 Python unit tests passed normally and with -O, including diagnostic categories, malformed/duplicate identities, incorrect grants and privacy canaries.
• On Linux AMD64 WSL2, the exact candidate passed nine synthetic loopback HTTP/transport cases and a read-only verification of the real policy. No invalid policy was installed in the datastore.
• Operator resume passed; all 18 persistent pods were Ready and all 11 PVC UIDs were preserved. Historical Job/pod identities, specs and status were unchanged.

Single-agent, focused qualification; full application acceptance, fresh installation and ARM64 runtime qualification are not claimed. Consumers should continue accepting the original generic message as an unclassified error.