Upload a complete task file

Reserve the file and return one short-lived upload request. Supply original size and SHA-256 hex. Send the whole original file: POST multipart/form-data with exact returned fields and file last, or PUT raw bytes. Then call the file complete endpoint. No client splitting or base64. Ready bytes are immutable. Upload capabilities are private and expire; S3 capabilities can only write a bounded incoming object and never a ready file. Programs, installers, disk images, shortcuts, and macro-enabled Office files are refused by name. Windows, macOS, and Linux programs, Office macros, password-protected zip files, zip files that contain programs, and PDFs with visible script or launch actions are also refused by content; completing such an upload removes it.