use squib for lambda fn on osx

add snapshot support

chore: bump workspace to v0.8.0

v0.7.0: CloudFront management plane + minimal pass-through data plane

[skip ci] add publish script

Update CHANGELOG.md

fix: handle null MetricAlarms in cloudwatch-test assertion

Use JMESPath null coalescing (|| `[]`) to handle the case where
DescribeAlarms returns null MetricAlarms instead of an empty array.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(s3): include checksum headers in object responses (#4)

## Summary

- Auto-compute CRC32 checksum during PutObject when no client checksum
is provided (matching AWS S3 default behavior)
- Populate `x-amz-checksum-*` headers in GetObject, HeadObject, and
PutObject responses from stored checksum data
- Preserve source object checksums during CopyObject operations

Closes #3

## Test plan

- [x] Run existing unit and integration tests (`cargo test`)
- [ ] Start ruststack with S3 service and verify with Go AWS SDK v2
client that GetObject no longer produces "Response has no supported
checksum" warning
- [ ] Verify PutObject response includes `x-amz-checksum-crc32` header
- [ ] Verify GetObject/HeadObject responses include the stored checksum
header
- [ ] Test with client-provided checksums (CRC32C, SHA256) to verify
they are preserved and returned correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

fix(ci): use correct check name with matrix suffix for wait-on-check

The build-rust job uses a matrix strategy, so the check name is
"build-rust (ubuntu-latest)" not "build-rust".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>