feat(web): add attachment staging lifecycle

[testikun]

Problem

The attachment work tracked by #344 has admission metadata validation in review, but no host-owned lifecycle for canonical temporary bytes. Browser filenames must not become filesystem authority, and staged bytes need exact command ownership and deterministic cleanup.

Value

Future composer and multimodal prompt work gets a fail-closed storage primitive with bounded resource use, single-consume semantics, and explicit stale or settled receipts.

Approach

Add a private attachment staging store that:

• writes payloads under server-generated file identities in a private host directory;
• binds every batch to the exact canonical workspace, Session id, and command id;
• serializes stage, consume, discard, and disposal mutations;
• enforces injected count, per-file, per-command, store-wide byte, and settled-receipt limits;
• rejects changed files and symlinks before reading;
• removes staged artifacts on consume, discard, failed integrity checks, and store disposal.

This is a focused backend slice and intentionally does not duplicate #365/#380 metadata admission validation or #384 UI work.

Validation

• bun run check
• bun run test: 1245 passed, 0 failed, 1 skipped; Vitest 30 passed
• focused attachment staging tests: 4 passed
• git diff --check

Impact

• User-visible behavior: none until the composer integration lands.
• Model-visible context/tools: none.
• Runtime/lifecycle: adds an opt-in host-owned temporary byte lifecycle; no current request path changes.
• Persisted config/data: none; artifacts are private and temporary.
• Compatibility/risk: additive module only. Limits are injected so the final upload path can use the authoritative admission policy without a second default.

Related to #344.

[testikun]

CI context: both Linux Node jobs reach the pre-existing packed standalone Web CLI smoke, install the tarball, and then the server exits before announcing its origin (kill: No such process). Windows and the other checks pass. This matches the independently reproduced fresh-install peer-dependency failure tracked in #328, where npm selects Pi 0.85.0 and @earendil-works/pi-server cannot be resolved. Evidence: #328 (comment)

This PR does not change package metadata, CLI startup, or peer-dependency resolution. Its local check, focused tests, full Node suite, and Vitest suite pass as recorded in the PR body.

[tt-a1i]

需要改：暂存没有 TTL，name/mime 也没有自己的上界

web/runtime/attachment-staging.ts：

• 崩溃且没走到 dispose() 会留下 0o700 目录，没有 TTL / 启动回收。
• validatePayloads 不限制 name / mime，完全指望还没合的 #365/#380。

staging 不该自带一份政策，但也不该在准入 PR 落地前把无界元数据写进 store。请先合 #365+#380（或把同样的边界搬进来），并给未 dispose 的根目录加 TTL 或启动清理。

绑定、独占队列、symlink/size fail-closed 这些是对的。

[tt-a1i]

Exact-head re-review of 9ebd185. The previous metadata bounds and missing cleanup findings have been addressed; focused tests pass (5/5). However, the new startup reclamation can delete a different live store and its unconsumed attachments. This is a lifecycle/data-loss blocker, independently reproduced with the real module in a unique temporary parent. No host/UI or deployed impact is claimed; the store is not yet wired to an upload route.

[testikun]

@tt-a1i 已补齐 TTL、name/mime 256 UTF-8 bytes 限制及回归测试；随后又补上 owner/liveness proof，避免启动回收删除仍存活的 store。

[testikun]

@tt-a1i 已修复 P1：startup reclaim 现在读取 sibling PID owner marker；owner 存活则保留，旧无 marker 根目录才按 TTL 回收。live-store/orphan 回归通过。