Problem

After artifact migration, prevent configuration changes from reintroducing shared internal build destinations or overriding uploader task identity.

Scope

• Lint evaluated Evergreen configurations and generated task configurations with their evaluated parent project.
• Reject legacy protected artifact destinations, unsafe relative object names, unsupported uploader arguments, and task identity overrides.
• Allow the release recovery inputs supported by the uploader and retain public release destination workflows.
• Resolve the included Atlas module upload findings before enabling checks for the full main configuration.
• Document that configuration lint does not replace trusted AWS credential scoping.

Validation

Focused lint regression tests, Bazel tests, evaluated main/nightly configuration checks, and generated-task checks.

Related Work

Lint draft PR. Depends on uploader infrastructure, producer provenance, and the artifact migration.