feat(web): add attachment staging lifecycle - #388

需要改：暂存没有 TTL，name/mime 也没有自己的上界

web/runtime/attachment-staging.ts：

• 崩溃且没走到 dispose() 会留下 0o700 目录，没有 TTL / 启动回收。
• validatePayloads 不限制 name / mime，完全指望还没合的 #365/#380。

staging 不该自带一份政策，但也不该在准入 PR 落地前把无界元数据写进 store。请先合 #365+#380（或把同样的边界搬进来），并给未 dispose 的根目录加 TTL 或启动清理。

绑定、独占队列、symlink/size fail-closed 这些是对的。

Exact-head re-review of 9ebd185. The previous metadata bounds and missing cleanup findings have been addressed; focused tests pass (5/5). However, the new startup reclamation can delete a different live store and its unconsumed attachments. This is a lifecycle/data-loss blocker, independently reproduced with the real module in a unique temporary parent. No host/UI or deployed impact is claimed; the store is not yet wired to an upload route.

Exact-head review of be9eab7. The staging design has useful binding and cleanup boundaries, but two independently reproduced P2 resource-lifecycle problems remain. Please fix these in this PR and add regression coverage; no author code was modified during review. This module is not yet connected to an upload route, so these are component findings rather than claims about deployed behavior. Related tracking: #441.

Reviewed exact head 51706c6.

The host-owned staging primitive is useful and is not wired into current user/model behavior, but two reproducible P1 integrity/lifecycle blockers remain:

• [P1] Changed bytes can be accepted as canonical. The store records and verifies path/type/size, but not content identity. On the exact head, staging safe, overwriting the payload with same-length evil, then consuming returns consumed with evil. Persist and verify a digest or authoritative opened-file identity, and close the check/read TOCTOU.
• [P1] discard marks the batch settled before deletion succeeds. If rm fails, the first call rejects, but a retry reports settled/discarded while the bytes remain. Only settle after cleanup succeeds, or persist an explicit failed/retryable cleanup state.

[P2] Workspace ownership is also raw absolute-string equality rather than a proven canonical path, so aliases can become distinct owners.

Focused tests and required CI are green, but they do not cover these exact failure cases. The P1s block merging this as the canonical attachment-byte authority.