checks: add opsTf-lib eval tests for monitoring helpers
Refactor flakeModules/lib/opsTf.nix to expose the pieces the tests need to inspect: - lift `lockDaysFor` from a let-binding inside `mkMonitoringBucketResources` to a top-level helper taking `objectLockMode` explicitly - split `mkMonitoringIamPolicyDoc` (the pre-JSON attrset) out of `mkMonitoringIamPolicy`, so callers and tests can inspect Action / Resource lists without parsing JSON perSystem/checks/test.nix wires `checks.opsTf-lib` via `lib.runTests` + `lib.debug.throwTestFailures`, asserting bucket versioning, object lock, lifecycle, secure-transport policy, IAM action allow/deny lists, and the lockDaysFor governance/soft branches. Failures abort `nix flake check` at eval time.
