Implement secure creation and atomic staging publication

[niteshpurohit]

Objective

Use the existing hardened filesystem primitives to create incomplete blob/sidecar state and publish it only after successful transaction completion.

Acceptance Criteria

• Opaque file IDs use existing CSPRNG/crypto entropy.
• Blob and sidecar remain unusable while incomplete.
• Publication uses safe atomic rename/state transitions.
• Modes, containment, owner checks, and no-symlink behavior follow existing filesystem security contracts.
• Failed publication leaves no usable partial pair.

Technical Considerations

• Do not invent a separate upload temp-file subsystem.