fix: complete presigned capability and upload transport contracts

BT-PRE-02: add the top-level PRESIGNED_TRANSFER_V1 protocol literal to the
capability request and response. A missing, V0 or V2 envelope is closed as
POLICY_REJECTED before the vault registers anything. The server negotiates by
request shape; fields are never dual-emitted into a strict decoder, and the
nested PRESIGNED_MULTIPART_V1 binding protocol is unchanged.

BT-PRE-03: aborting a controller does not settle a fetch that ignores its
signal, so both presigned scopes now race the task, cancel a late response body
and survive a throwing scheduler without leaking the external abort listener.

BT-PRE-04: the vault owns its registration invariants, re-checking method,
href/origin/path agreement, embedded credentials, byte bounds, digest shape and
expiry, so a second issuer cannot register a weaker capability of the same type.

BT-PRE-05: decode each path segment once and require it to round-trip through
the canonical uppercase percent encoder, closing %2f, %5c, %252e%252e, mixed-case
escapes and encoded NUL while still admitting valid opaque UTF-8 segments.

BT-UP-02: inject and snapshot the upload transport clock and scheduler, so
Retry-After delta-seconds and HTTP-date resolve against the same captured now
and a clock rollback clamps to zero instead of producing a negative delay.

BT-IMG-01: make the image resolve() lifetime signal required, replacing the
hidden PRIMARY_REQUIRED preset precondition with a type-level one, and add the
negative typecheck fixture and gate that prove it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/fixtures/typecheck/invalid-image-cdn-resolve-signal.ts

@@ -0,0 +1,27 @@
+import type {
+  ImageAssetReference,
+  ImageCdnPresentationPort,
+  ImagePresetReference,
+} from "../../../src/application/ports/browser-transfer/image-cdn.ts";
+
+/**
+ * BT-IMG-01. Migration step 1.
+ *
+ * The `PRIMARY_REQUIRED` preset already reports a missing signal as
+ * `UNSUPPORTED` at runtime, which is a hidden preset precondition rather than a
+ * type-level one. This fixture pins the intended end state: `resolve()` must
+ * refuse a call with no lifetime signal at compile time.
+ *
+ * It is expected to FAIL typechecking until `signal` becomes required on the
+ * port. That flip is a separate major-contract change, per the review's own
+ * instruction not to mix it with the P1/P2 correctness work.
+ */
+declare const images: ImageCdnPresentationPort;
+declare const asset: ImageAssetReference;
+declare const preset: ImagePresetReference;
+
+// Expected error: `signal` is missing.
+void images.resolve({ asset, preset });
+
+// Expected error: `signal` may not be undefined.
+void images.resolve({ asset, preset, signal: undefined });