Add direct media asset support for release website automation

Summary

Improve the Perform website automation surface so release-to-website workflows can prepare featured images and supporting media without relying only on existing media or externally hosted public URLs.

This supports the release-to-website pilot in #147, but it should not block the first MVP because the MVP can use existing media or owner-approved public asset URLs.

Current capability gap

The current site automation surface can:

• list and read media library attachments,
• upload media from a public HTTP(S) URL,
• assign existing/uploaded media as featured images,
• update media metadata,
• create/update draft or pending posts/pages/docs.

The current surface cannot:

• upload generated image binary data directly,
• search/select CC0/open-license imagery through the connector,
• generate or store a release featured image entirely inside the site workflow.

Those missing pieces make release blog featured images harder to automate safely. The current workaround is to use an existing media item or upload from an owner-approved public URL.

Proposed direction

Add a safe media asset bridge for release website automation:

• Direct image-data upload support with MIME/type/size validation and SSRF-safe handling.
• Optional integration with an approved design/image generation workflow that returns a reviewed asset before upload.
• Attachment metadata requirements: title, alt text, caption, source/provenance note, and intended post/page/doc target.
• Dry-run support that returns the planned attachment metadata and destination before upload.
• Idempotency key support so retries do not duplicate media.
• Explicit owner approval gate before assigning media to a public release post or publishing any content.

Acceptance criteria

• Release automation can upload or attach a generated/approved image without requiring a public temporary URL.
• Uploaded media is created as an attachment with useful title, alt text, caption, and source/provenance metadata.
• The workflow can assign the media as a featured image to draft/pending content only.
• The workflow refuses oversized, unsupported, or unsafe file types.
• The workflow supports dry-run and idempotency.
• No content or media is published automatically.

Validation

• Dry-run media upload plan shows file name, MIME type, destination content ID, alt text, and source/provenance.
• Upload test creates one attachment and can be retried without duplication.
• Featured image assignment works on draft/pending release posts.
• Public publish remains manual owner action.

Non-goals

• Do not add automatic public publishing.
• Do not add unrestricted web image scraping.
• Do not change plugin release automation.
• Do not change pricing, licensing, privacy, security, or product positioning.