Give a private subnet access to Amazon S3

The finance team's nightly reporting service was recently moved into a private subnet. Reports still generate successfully, but uploads to Amazon S3 now fail. Security does not want the service to have general internet access, and the existing public-facing network must continue working as-is. Restore private access to S3 without introducing general internet egress.

Repair network.yaml so the private subnet can reach current-Region Amazon S3 without a general internet path. Preserve the supplied topology, existing public route, and private subnet's addressing safeguards.