Plan Workspace Uploads

Diff a client's {path, sha256} manifest against workspace storage.

Files already stored under the same digest come back unchanged; the rest get a presigned PUT bound to their digest, so the bytes go straight to the object store. This is what agentarea files sync calls, and the same plan the MCP workspace_files.upload_urls tool returns.