Add message-bound image and file attachments (JVNAUTOSCI-2756)

[witbrock]

Merge decision: not ready — successful normal-chat sends and the live receiving-agent handoff remain unverified because the operator fixture disables generation and does not provide an active candidate consumer. Do not merge or deploy yet.

User outcome

Users can attach clipboard images, dropped files and picker selections to Messages and ordinary chat, preserving captions, original filenames and message association. JVNAUTOSCI-2756.

Material changes

• Reuse private file-copy/blob storage and the existing pending-image composer for general files, retries and removal. Pending uploads no longer create unrelated chat turns; existing workflow file binding is preserved.
• Persist canonical attachment descriptors in direct-message metadata and normal-chat turns. Recipient downloads check the exact canonical message and file binding, without widening the original file's audience. Deleted messages deny attachment reads. Archive-source images cannot be forwarded through this upload-only path.
• Deliver supported text and image references to the existing MCP/provider path. Prepare original bytes in receiving Codex inbox/resumed-task run directories; retain explicit unsupported/unavailable limitations. These worker changes need separate coherent activation coordinated with 2748/2750.
• Keep attachment-only Send visible on narrow screens and constrain pending previews to a scrollable area.

Evidence

• 198 targeted backend tests passed: attachment access/content, images, message services/routes, direct-message MCP, file upload, queue, inbox and worker.
• 39 frontend tests passed: workflow file binding, Messages send recovery/exchanges and attachment recovery. Changed frontend modules passed static lint; focused Python lint and diff checks passed.
• Authenticated disposable Alice/Bob browser replay passed Messages paste, drop, text file, caption plus attachment, attachment-only send, original-byte recipient read-back, uploader-only URL denial, remove, upload retry, lost-response retry with idempotent reuse, refresh persistence and desktop/360px controls. Clipboard/drop events contain real fixture bytes; login uses the standard localhost browser-test route.
• Normal-chat fixture replay passed paste/drop/file preparation, remove-before-send, injected upload failure/retry, narrow picker and draft preservation after rejected send. The standard send request carried all three IDs; the host fixture returned 403 generation_disabled_in_browser_fixture. This is not successful normal-chat send evidence.
• Agent byte preparation/provider delivery has targeted fixture evidence only. No receiving model/controller runtime has been activated or claimed to inspect an image.

Ship boundary

Remaining minimum evidence: operator-enable an isolated allowed non-Sol normal-chat generation path on this candidate, replay successful sends and persisted turns, and verify a receiving agent's real handoff with candidate worker/backend module provenance. Deployment must wait for these results and a verified merged SHA.

Stop shipment for wrong-recipient access, attachment loss, false successful-send display or broken ordinary text input. No new storage provider, credentials, migrations, membership changes or production fixture writes. General binary interpretation, every device and unrelated UI/migration work remain outside scope.

Browser product revision: 77fd57649410e179d2a773c40c96ce9080bce649; the subsequent commit changes only the browser test. Detailed local receipts and the bounded operator request are retained in .run/attachments/ and .run/JVNAUTOSCI-2756-handoff.txt in the controller-owned isolated checkout.