Call the finalizeAsset MCP tool

Second half of the signed-upload flow: validate bytes previously PUT to a requestUploadUrl upload_url (size checked from storage metadata before the bytes are even downloaded, then magic-byte sniffed as png, jpeg, webp, gif, pdf, docx, or markdown/plain text, never by the declared content type and never svg or html, metadata stripped for images, workspace storage quota enforced) and publish them as a hosted asset. Returns the same url/name/content_type/bytes shape as uploadAsset plus kind (image, pdf, docx, or markdown); the name works as asset_name in insert_image/attachImageToPost. The staging object is deleted whether validation passes or fails, so a rejected upload leaves nothing behind.

Called through the Actions bridge: the response is that tool's own result, wrapped as { data: <tool result> } under HTTP 200. Billing, daily-cap, and confirm-step outcomes are embedded INSIDE data, never remapped to an HTTP status (see the templated /api/v1/actions/{toolName} operation above for the full protocol, and x-mcp-actions for this tool's machine-readable scope/cap/confirm_behavior fields). Authentication, request-shape, and optional idempotency-protocol failures still use their documented non-200 statuses.