Finalize support attachment upload

Verify an upload owned by the caller in its organization. Stored content must match the declared media type and exact byte count. Mismatches fail the attachment. Expired uploads conflict. A repeated successful finalization returns the existing ready attachment. messageId is null until it is sent in a message. Returns complete attachment metadata. Accepts no body or an empty JSON object. Requires support.write and a user token. Organization API keys cannot call this operation. Uses customer permissions, with no operator or staff bypass. New mutations require rollout-agent-access-writes and allow-public-agent-writes to be enabled. Pausing writes leaves history and downloads available. Known IDs resolve their own organization; organizationId can require a specific tenant. Creation defaults to the saved organization.