Create Attachment Upload Url

Mint a presigned PUT for a task attachment uploaded directly to the store.

The client-declared sha256 is bound into the signature as ChecksumSHA256, so the object store rejects a body that does not hash to it — the upload is content-verified without the API ever seeing the bytes. The returned ref is consumed by the task-create endpoint exactly like a server-proxied one.