Harden DropPoint receiver lifecycle and storage

[shunichironomura]

Summary

• enforce strict DropPoint protocol-v2, multipart, manifest, MIME, timestamp, base64url, and canonical filename validation
• persist owner-only resumable receiver state and atomically install verified bundles with durable identity receipts
• commit local attachment records before close, resume close after restart, and scrub capabilities only after terminal handling
• centralize bounded HTTP behavior and capability redaction, and add jittered retry handling for receiver polling
• import the normative DropPoint policy fixtures and document the durable bundle layout

Testing

• just check-all
• end-to-end mock-relay coverage for pickup, durable installation, execution recording, restart, close retry, and secret removal