Add release protection and retry recovery to the existing task-owned artifact uploader.

1. Keep release artifacts consistent on retry. Preserve the first binary and its provenance together: if retry B rebuilds an earlier upload A, keep A. Apply requested access permissions even when preserving contents. Existing release settings select this protection; ordinary development patches can replace their artifacts.
2. Recover interrupted uploads safely. Save a private recovery bundle before publishing individual files. If the binary uploads but provenance fails, restore the original pair on retry. Validate the bundle and its ETag link without ListBucket permission; reject invalid or unreadable recovery data. Handle supporting-file paths and read-only Windows outputs correctly.

This PR provides the capabilities; #64927 connects existing build tasks to them. Task-owned storage paths were introduced by the already-merged #64926. AWS credential restrictions and bucket-policy enforcement remain separate infrastructure work.

Latest nightly verification: 37 tasks across Amazon Linux community/enterprise, enterprise ARM64, and enterprise Windows have started on stack tip 081cd1baa40, using release upload mode and package/provenance, crypt-package, and Windows MSI checks. Results are pending.

Stack: #65042 → #65043 → #64803. #64927 is merged into #65043.