Close the attempt after the client's direct-to-GCS PUT.

Carries the capture metadata for an early-minted attempt (legacy clients send {} and everything is already on the row), re-runs the rules that could not run at mint time against the merged result, verifies the object landed with exactly the reported size (422 otherwise — the attempt stays open, the client may re-PUT and retry), then flips progress to Pending and dispatches the validation worker. The response is the full task payload, as GET /available/{taskUid} returns it.

Authorizable by the usual credentials or by the attempt's one-time complete token; the token survives a 422 → re-PUT → complete retry and dies with the first successful close.