feat(runtime): publish approved media from the scheduler

Approved posts may carry mediaAssetIds and altTexts since the repository
gate was lifted, but the scheduler built connectors without an asset
loader, so Mastodon and Telegram rejected every post with media as
INVALID_POST and alt texts never reached them.

- media.ts: loadAsset reads media_assets inside the execution's tenant
  (app.workspace_id, RLS forced); openAsset fetches the sealed object,
  opens the SPENC1 frame with S3_KEK and checks the content hash.
  Read-only; bytes go worker to provider and never through the API.
- preparePostForDispatch maps positional altTexts onto
  providerMetadata.altText keyed by asset id.
- Instagram joins the scheduler registry so its posts fail with an
  explicit connector error instead of UnknownProviderError.

pnpm-lock.yaml

@@ -502,6 +502,12 @@ importers:
 
   packages/connector-runtime:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.1146.0
+        version: 3.1146.0
+      '@tactical-media-broadcast-hub/connector-instagram':
+        specifier: workspace:*
+        version: link:../connector-instagram
       '@tactical-media-broadcast-hub/connector-mastodon':
         specifier: workspace:*
         version: link:../connector-mastodon