feat: stat, object acl and iam policy

[designcode]

Note

Medium Risk
Moderate risk due to a broad refactor of CLI routing/help generation and new nested command dispatch logic (including dynamic module imports). New IAM policy management touches auth-dependent flows and could affect user-facing behavior if command/spec wiring is wrong.

Overview
Adds a PR GitHub Action (.github/workflows/pr.yaml) that runs npm ci, build, and tests on pull requests.

Expands the CLI command model from 2-level command/operation to fully nested commands by making CommandSpec recursive, updating specs.yaml from operations to commands, and refactoring src/cli.ts to register/dispatch commands via path parts (including alias arrays), with added command-name validation to mitigate path traversal.

Introduces new user-facing commands: stat now works (overall storage stats with no args, bucket info, or object metadata); objects set updates an object’s access level and optionally renames it; and iam policies adds list/get/create/edit/delete flows (OAuth-only) with interactive selection when the policy ARN isn’t provided and support for document input via file/inline JSON/stdin.

Improves table output to respect terminal width by adding column shrinking/truncation (maxWidth, ellipsis), updates @tigrisdata/iam and @tigrisdata/storage dependencies, removes the unused stub src/lib/_stat.ts, and extends tests to cover the new help output and nested spec lookup (getCommandSpec).

^{Written by Cursor Bugbot for commit 04b5c7e. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[github-actions]

🎉 This PR is included in version 2.8.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀