Tier originals to Intelligent-Tiering via bucket lifecycle (AWS-native item 2)

Tier originals to Intelligent-Tiering via bucket lifecycle (AWS-native item 2) The last AWS-native item. Intelligent-Tiering gives the access-pattern prediction §19 wanted off the lifecycle engine — frequent/infrequent movement with no retrieval fee — while dam keeps the policy: never archive the master proxy, honour pins and legal hold, produce a reviewable plan. Delivered as bucket config, not code: an aws_s3_bucket_lifecycle_configuration transitions current versions to INTELLIGENT_TIERING at day 0. Removing the rule is the whole of the rollback, so nothing needs a migration. The noncurrent-version gate — object_placements carries no version_id, so dam tracks only the current object and item 4's inventory scrub reads current versions only — is answered the reversible way: a noncurrent_version_expiration of 30 days lets AWS reclaim old versions on a timer, rather than adding a version column and teaching the engine and the scrub about versions. The IT rule is bucket-wide because keys are tenant-first (/o/...), so an S3 prefix filter cannot select originals across tenants — the same constraint that kept the staging-expiry rule out of a prefix. Tiering the exempt namespaces (p/, t/, c2pa/) to IT is harmless: IT never archives, so they stay instantly readable, which is what D5 actually protects. dam still enforces "never archive the proxy" via permitted_class. All three choices, and the D5 letter-vs-spirit reasoning, are recorded in DECISIONS.md. terraform validate + fmt clean.