feat: publishing registry media seam (loadAsset/openAsset) + SPENC1 decrypt + multipart transport

The Mastodon connector's uploadAll resolves asset ids via loadAsset/openAsset.
The registry wires these hooks from a mediaResolver that the scheduler injects:
media_assets lookup (workspace-scoped via SET LOCAL) + R2 download + SPENC1
decrypt (extracted from the api's storage into connector-runtime/media.ts).
provider-fetch gains serializeBody for multipart media uploads through the
pinned transport channel.

pnpm-lock.yaml

@@ -167,6 +167,9 @@ importers:
 
   apps/scheduler:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: 3.1146.0
+        version: 3.1146.0
       '@tactical-media-broadcast-hub/connector-mastodon':
         specifier: workspace:*
         version: link:../../packages/connector-mastodon