Get Bucket Path

The S3 bucket to surface in the "you'll have access to <bucket>" hint, or null if none is provisioned yet. Bucket identity is not client-specific, so this is gated only by Enterprise + Block role (not client-scoped).

catalog selects both the row to match and how: a dataset can have rows in both catalogs, so it must be an explicit input rather than inferred.

• Bulk flow (default, catalog=bulk): exact SKU match on (dataset_id, lag, cut) within the bulk catalog.
• Sample flow (catalog=sample): sample access is lag-agnostic, so resolve the dataset's sample bucket rather than an exact SKU.