Harden resumable upload validation and lifecycle

[thymikee]

Summary

Harden resumable-upload validation and lifecycle ordering so rejected operations cannot leave a reusable ticket in an inconsistent state.

Security-sensitive findings and reproduction details are intentionally omitted from this public issue. The implementation PR will carry the reviewed fix and regression evidence.

Scope

• Enforce request metadata and streamed-byte contracts consistently.
• Make each accepted append transactional and retry-safe.
• Serialize receive, finalize, expiry, rollback, and cleanup ownership per ticket.
• Preserve existing valid full-upload and resume behavior.

Acceptance criteria

• Rejected chunks do not advance or corrupt the stored upload.
• Valid retries and finalization continue to work after recoverable rejection.
• Terminal failures invalidate the ticket and clean caller-owned temporary data.
• Concurrent receive/finalize/expiry operations cannot race filesystem state.
• Public HTTP status, offset, tenant-ownership, and successful resume contracts remain compatible.