feat(get-rhema): expose the S3 API publicly for release uploads

The release runners cannot resolve the in-cluster Service name, so the
binary uploads died on DNS. s3.rhema.rs fronts the same Garage through
Caddy and Traefik, with its own certificate, matching the web face's
shape (Caddy terminates, Traefik routes, bucket by path).

dns/production/rhema.rs.yaml

@@ -15,6 +15,14 @@ get:
   ttl: 300
   type: A
   value: 82.64.154.58
+s3:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: false
+  ttl: 300
+  type: A
+  value: 82.64.154.58
 www:
   octodns:
     cloudflare: