feat(server): add fs.write endpoint - #49466

Adds POST /api/experimental/fs/write so a client can put raw bytes on the server's filesystem. First consumer: #49467 stages attachments the model can't read natively under the server tmp dir.

flowchart LR
  C[Client] -- "POST /api/experimental/fs/write?path=…<br/>body: raw bytes (application/octet-stream)" --> S[Server]
  S -- "path.resolve(location.directory, path)" --> R{absolute?}
  R -- yes --> A["/any/where/file.bin"]
  R -- no --> L["&lt;location&gt;/relative/file.bin"]
  A & L --> W["writeWithDirs → { path: resolved }"]

// packages/protocol/src/groups/fs.ts
HttpApiEndpoint.post("fs.write", "/api/experimental/fs/write", {
  query: WriteQuery,                                             // location + path
  payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()), // raw body, no base64
  success: Location.response(FileSystem.Write),                  // { path: AbsolutePath }
})

// generated promise client
await api.file.write({ location, path: `${info.paths.tmp}/uploads/${id}/${name}`, payload: bytes })

• Creates parent directories; returns the resolved absolute path (mixed separators from another OS normalize server-side).
• Unlike fs.read, not confined to the location: the point is to reach paths.tmp from GET /api/info, which the model is already told to prefer and permitted to access.
• Promise-client codegen learns binary request bodies (mirrors the existing binary response support used by fs.read); the Effect client omits the endpoint like fs.read. workerd stub reports unavailable.
• Also fixes service.test.ts on Windows CI: it compared os.tmpdir() (an 8.3 short name on the runner) against the realpath'd paths.tmp the server reports.