notion-datasource-sync: model files media metadata and lifecycle authority

Parent epic: #698

Problem

Datasource-sync has partial metadata and file support, but durable files/media and container lifecycle semantics need a separate authority model before they can be considered production-ready.

Current Evidence

• Data-source and database title/description metadata are supported.
• Page archive/restore/create paths have coverage.
• External URL file attach for empty file properties is supported through explicit staging.
• Notion-hosted signed URLs are excluded from stable identity.
• File-upload identity, replacement/delete/preserve-existing, writable icons, parent/container placement, and local-first database/data-source creation are not evidenced as complete.

Scope

• Model durable File Upload identity, expiry, retry status, read-after-write verification, cleanup, and redaction-safe diagnostics.
• Define replacement/delete/preserve-existing behavior for files properties.
• Extend icon/cover handling only when file/custom/external identity is proven.
• Define data-source/database parent, container placement, trash/lock/inline lifecycle authority.
• Decide whether local-first database/data-source creation belongs in datasource-sync or remains out of scope.
• Improve repair/manifest evolution for adopted workspaces.

Repro / Proof Instructions

1. Start with fake-service tests for file upload lifecycle and metadata conflict keys.
2. Use live scratch data sources/files only after fake lifecycle is deterministic.
3. Prove upload attach, read-after-write verification, cleanup, retry, and redaction.
4. Prove metadata changes do not collide with row/schema/body authority surfaces.

Acceptance Criteria

• File/media identity does not depend on expiring Notion-hosted URLs.
• File operations are idempotent or explicitly reconciled after interruption.
• Metadata/lifecycle operations have separate base hashes/conflict keys from row/schema/body work.
• Capability docs clearly separate shipped title/description support from deferred lifecycle/media support.

Start with the fake-service tests for file upload lifecycle and metadata conflict keys, then use live scratch data sources and files only after the fake lifecycle is deterministic. Verify upload attachment, read-after-write, cleanup, retry, and redaction behavior. Done means the acceptance criteria hold and capability docs distinguish shipped title/description support from deferred lifecycle/media support.