feat(web): add attachment staging lifecycle

[testikun]

Problem

The attachment work tracked by #344 has admission metadata validation in review, but no host-owned lifecycle for canonical temporary bytes. Browser filenames must not become filesystem authority, and staged bytes need exact command ownership and deterministic cleanup.

Value

Future composer and multimodal prompt work gets a fail-closed storage primitive with bounded resource use, single-consume semantics, and explicit stale or settled receipts.

Approach

Add a private attachment staging store that:

• writes payloads under server-generated file identities in a private host directory;
• binds every batch to the exact canonical workspace, Session id, and command id;
• serializes stage, consume, discard, and disposal mutations;
• enforces injected count, per-file, per-command, store-wide byte, and settled-receipt limits;
• rejects changed files and symlinks before reading;
• removes staged artifacts on consume, discard, failed integrity checks, and store disposal.

This is a focused backend slice and intentionally does not duplicate #365/#380 metadata admission validation or #384 UI work.

Validation

• bun run check
• bun run test: 1245 passed, 0 failed, 1 skipped; Vitest 30 passed
• focused attachment staging tests: 4 passed
• git diff --check

Impact

• User-visible behavior: none until the composer integration lands.
• Model-visible context/tools: none.
• Runtime/lifecycle: adds an opt-in host-owned temporary byte lifecycle; no current request path changes.
• Persisted config/data: none; artifacts are private and temporary.
• Compatibility/risk: additive module only. Limits are injected so the final upload path can use the authoritative admission policy without a second default.

Related to #344.

[testikun]

CI context: both Linux Node jobs reach the pre-existing packed standalone Web CLI smoke, install the tarball, and then the server exits before announcing its origin (kill: No such process). Windows and the other checks pass. This matches the independently reproduced fresh-install peer-dependency failure tracked in #328, where npm selects Pi 0.85.0 and @earendil-works/pi-server cannot be resolved. Evidence: #328 (comment)

This PR does not change package metadata, CLI startup, or peer-dependency resolution. Its local check, focused tests, full Node suite, and Vitest suite pass as recorded in the PR body.

[tt-a1i]

需要改：暂存没有 TTL，name/mime 也没有自己的上界

web/runtime/attachment-staging.ts：

• 崩溃且没走到 dispose() 会留下 0o700 目录，没有 TTL / 启动回收。
• validatePayloads 不限制 name / mime，完全指望还没合的 #365/#380。

staging 不该自带一份政策，但也不该在准入 PR 落地前把无界元数据写进 store。请先合 #365+#380（或把同样的边界搬进来），并给未 dispose 的根目录加 TTL 或启动清理。

绑定、独占队列、symlink/size fail-closed 这些是对的。

[testikun]

已按 review 修复并推送到 9ebd185：

• staging store 启动时会按 stagingTtlMs（默认 1 小时）回收父目录中过期的 .openpi-web-attachments-* 根目录，崩溃后未走 dispose() 的目录不会永久遗留。
• name 和 mime 各自限制为最多 256 UTF-8 bytes，并在准入阶段 fail-closed。
• 新增过期根目录回收和元数据上界回归测试。

attachment-staging 测试 5/5 通过，Biome 和 diff 检查通过。