feat(upload): bound upload attempts with a size-scaled deadline

[ben-miru]

Summary

• Every upload attempt is now wrapped in tokio::time::timeout at the Uploader actor seam (Worker::attempt_upload), with a size-scaled deadline: a 120 s floor plus 1 s per 64 KiB of job size (UploaderOptions::attempt_deadline, saturating arithmetic with div_ceil and a zero-divisor guard).
• Why: gcs::Store::put carries no timeout by design and documents that callers must enforce a size-scaled deadline — but no caller did, so a silently dead connection during a GCS transfer stalled the uploader round indefinitely and backed up the queue. S3 already had implicit stall protection via AWS SDK defaults; this bounds the whole attempt uniformly for both stores.
• Deadline expiry surfaces as the new retryable UploadErr::AttemptTimeoutErr and rides the existing backoff/requeue/attempt-cap machinery unchanged.
• Doc contracts updated (UploadExecutor cancel-safety now covers deadline expiry; the gcs::Store::put deadline paragraph points at the actor's bound) and tests added (attempt_deadline_formula unit tests plus the paused-clock hung_attempt_times_out_and_is_retried acceptance test).
• ExecPlan recorded and completed at plans/completed/20260717-upload-attempt-deadline.md.

Validation

• Full suite: 1515 passed, 0 failed; covgate upload at 96.81% against its 96.00 gate.
• CI green on the branch (lint, test, tools).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}