[antoinetoussaint-byte]

Local MinIO and gateway containers previously exposed only suffixed runtime names, so the CLI could not prove their loaded parent service during repeated runtime setup. Both constructors now supply s.Identity through Core's DockerEnvironment.WithServiceIdentity before first use. Core owns exact label encoding/validation; CLI retains its independent scope, name and port checks.

Classification: fix at the producer by consuming the shared owner API. No name inference, second attribution mechanism or broad cleanup is added. README.md documents exact parent labels, credential-driven replacement with retained data, and the explicit recovery limits for older unlabeled containers. The custody test now checks lifecycle response statuses and both generations' exact labels, bytes and complete metadata.

Final reviewed source f913495 selects Core bc4e15ca through codefly agent deps --pin, without workspace overrides. Supported standalone build, vet and tidy checks pass. Local unit/race suite passes; a gateway image built from this exact tree passes selected real PutGet and retained-data custody e2e in 91.165s with no selected skips. Exact-head CI passes build/test, race, integration-minio, full agent-runtime-e2e and image-sbom. Independent initial and changed-pin reviews accept the implementation; source reports remain available in /tmp/core858-objectstorage-review.md and /tmp/core858-consumer-provenance-followup.md.

Earlier qualification's initial IPv6 loopback readiness failure remains unexplained; its unchanged retry and the final exact-image run pass, and no unsupported contention diagnosis is claimed. Root separately proved repeated CLI-driven retained-data behavior with the previous owner candidate. This PR qualifies source integration, not the new stable agent/gateway artifacts. Stable Core pin, merged-ref gateway image publication/lock adoption and agent release verification follow the existing owner tools. Real S3/GCS/Azure and cloud deployment were not exercised.