feat: harden storage integration boundaries

[kauandotnet]

What changed

• add the package-owned files-sdk S3 driver subpath
• add conditional ETag/version promotion for verified staged objects
• require a parsed Gateway key policy unless unsafe unscoped keys are explicitly enabled
• make storage errors interoperable across duplicated package copies

Why

Private tenant attachment workflows need server-owned key boundaries and race-safe object promotion without app-local S3 adapters.

Impact

@nestm/storage is projected to release as 0.1.0-alpha.3.

Validation

• unit and Express/Fastify E2E suites
• package, publint, ATTW, and packed-consumer gates
• integration API linked and nine-package packed attachment matrices
• release preflight: lint, formatting, TypeScript, diff hygiene, and Changesets status