Instance attachments: default distinct file name behavior

Followups from #363. These were posed there as open questions, and this issue captures decisions we made on those questions in Slack. We decided:

- [ ] The Collect-like distinct file name behavior should be provided by the engine, as the default when a client does not configure the behavior. Specifically, we'll produce filenames as `UPLOADED_AT_MILLISECONDS.ext`
- [ ] The engine will implement file name collision detection, appending the index of an upload as a suffix when two uploads resolve the same file name _on serialization_. Collisions would be highly unlikely to occur with the above default behavior _in the real world_, though they're more likely to occur in test depending on how timers are handled. This minor addition would be useful for that alone.
- [ ] We can retain an engine/client interface for clients to configure this behavior. The above represents a change to the default behavior. Many tests which currently expect no distinct filename behavior at all will be updated to express that explicitly, and in the future we can consider exposing the config so downstream users (e.g. in a host application) can express greater control over file name behavior overall.

Start by locating the engine's attachment filename generation and serialization paths, then trace the engine/client interface that configures filename behavior. Update the default naming and serialization collision handling, revise tests that currently expect no distinct filenames, and verify explicit client configuration remains supported.

Written by the indexing model from the issue text.