Internal workers-v1 build job app release actions: begin, reserve blobs, create the release, renew its manifest grant, and continue bounded verification until ready

Action result. reserve returns present or upload per blob, and only upload carries an exact-key write-once PUT grant (URL and required headers, at most 300 s); create and manifest-grant return one manifest PUT grant; complete returns either staged verification progress (repeat complete) or the ready release. No storage credential is returned.