NA-0344: add production size-class harness

[Tebbens4832]

Goals: G1, G2, G3, G4, G5

Impact: Adds the bounded qsl-attachments production size-class policy/harness selected by NA-0344. The implementation introduces opt-in qsl_attachments_production_size_class_v1 class computation and persisted class metadata while preserving existing exact ciphertext storage/fetch behavior and API routes.

No-regression: qsl-server remains unchanged; qshield demo evidence remains reference/oracle only; existing object bytes, capability scope, retention/purge, recovery, quota, and reject behavior remain fail-closed. This PR makes no deployment, dependency, workflow, manifest, branch-protection, or public-copy changes. It makes no production-readiness, public-internet-readiness, external-review-complete, anonymity, metadata-free, untraceable, attachment-size-hidden, timing-hidden, or traffic-shape-hidden claim.

Tests/Vectors: cargo fmt --all -- --check; cargo clippy --all-targets -- -D warnings; cargo build --locked; cargo test --locked; focused tests/production_size_class_policy.rs covers small/medium/large objects, invalid config rejection, oversize rejection, malformed descriptor/object rejection, retention/purge, cold full-root backup boundary, secret-free artifacts, qsl-server boundary, and qshield demo small-class compatibility.

qsl-protocol companion PR required: yes, after this qsl-attachments PR merges and required rust is green.

Boundary notes:

• qsl-server integration remains out of scope.
• qshield runtime remains out of scope.
• No production deployment or public-internet behavior is authorized.
• No dependency, Cargo manifest/lockfile, or workflow changes are included.
• Backup/deploy/secrets boundary remains cold full-root backup plus matching config; tests use temp directories and no secret-dependent fixtures.
• Required rust check must pass before merge.