feat(write-skill): GED attach op — upload the source document onto its invoice (erp#43)

document-attach.sh uploads a source piece (the supplier's own PDF) onto an
invoice's GED via POST /documents/upload — idempotent by (object, filename,
sha256): before any POST the object's GED is listed and a same-named entry is
downloaded back and sha256-compared. Identical → deduped no-op; different
content → ABORT (refuse-never-repair, overwriteifexists always 0, never
Dolibarr's overwrite flag). Read-back after upload: re-list + download +
sha256-verify. Module-relative download paths are derived from the listing's
fullname (supplier invoices carry an id-derived get_exdir prefix like
9/2/FAF2026013/…, so reconstruction would be wrong).

Promote integration: new `attach` op in promote-plan/promote-apply (OP_SCRIPT),
object_id resolvable via @ref and #supplierinvoice lookups; a relative `file`
resolves against the manifest's directory (replay packs carry pdfs/ beside the
manifest, gitignored — README documents the books@ re-fetch message ids).
promote-plan prints each file's sha256 (or a loud MISSING) at review time.
CLI: `arcodange sandbox attach`.

Proof: offline case 12 in tests/run-tests.sh (upload body, dedupe, conflict
abort, field refusal, manifest-relative resolution via stubbed /documents);
live: manifest-C-ged-attach.json applied twice on the sandbox — run 1 four
created, run 2 four deduped, one GED file per FAF2026010-013, stored sha256s
equal to the re-fetched sources; tests/replay-idempotency.sh extended with an
attach op (4 created → 4 deduped, ged_files count unchanged) and a live
same-name/different-bytes abort verified.

Closes erp#43

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRShc4QhLLU73FLHx9vskh

.claude/skills/dolibarr-sandbox-write/tests/stub-dol-write.sh

@@ -28,6 +28,9 @@
 set -euo pipefail
 STATE="${STUB_STATE:?stub-dol-write.sh: STUB_STATE not set}"
 METHOD="$1"; ENDPOINT="$2"; BODY="${3:-}"
+# dol-write.sh accepts @file bodies (document-attach.sh uses one for the base64
+# payload) — dereference it here so the recorded body is the JSON, not "@/path".
+[[ "${BODY}" == @* ]] && BODY="$(cat "${BODY:1}")"
 case "${METHOD} ${ENDPOINT}" in
   GET\ *"/payments"*)
     if [[ -f "${STATE}/payments.json" ]]; then
@@ -120,6 +123,55 @@ json.dump(rows, open(p, "w"), ensure_ascii=False)
 PY
     echo "88"
     ;;
+  "GET /documents/download?"*)
+    # Serve document_download.json when staged; else (post-upload read-back)
+    # synthesize from upload_body.json; else the live 404.
+    if [[ -f "${STATE}/document_download.json" ]]; then
+      cat "${STATE}/document_download.json"
+    elif [[ -f "${STATE}/upload_body.json" ]]; then
+      python3 - "${STATE}/upload_body.json" <<'PY'
+import base64, json, sys
+b = json.load(open(sys.argv[1]))
+print(json.dumps({"filename": b.get("filename"), "content-type": "application/pdf",
+                  "filesize": len(base64.b64decode(b.get("filecontent", ""))),
+                  "content": b.get("filecontent", "")}))
+PY
+    else
+      printf '%s' '{"error":{"code":404,"message":"Not Found"}}'
+      echo "stub-dol-write.sh: HTTP 404 on GET ${ENDPOINT}" >&2
+      exit 1
+    fi
+    ;;
+  "GET /documents?"*)
+    # Serve documents.json when staged; else (post-upload read-back) a listing
+    # built from upload_body.json — with the supplier-invoice get_exdir prefix
+    # (0/3/REF/…) so the relative-path derivation is exercised; else the live
+    # Dolibarr behavior: an object with no documents answers HTTP 404, not [].
+    if [[ -f "${STATE}/documents.json" ]]; then
+      cat "${STATE}/documents.json"
+    elif [[ -f "${STATE}/upload_body.json" ]]; then
+      python3 - "${STATE}/upload_body.json" <<'PY'
+import base64, json, sys
+b = json.load(open(sys.argv[1]))
+ref, fn = b.get("ref", "REF"), b.get("filename", "file.pdf")
+print(json.dumps([{"name": None, "relativename": fn, "type": "file",
+                   "level1name": ref,
+                   "fullname": "/var/www/documents/fournisseur/facture/0/3/%s/%s" % (ref, fn),
+                   "size": len(base64.b64decode(b.get("filecontent", "")))}]))
+PY
+    else
+      printf '%s' '{"error":{"code":404,"message":"Not Found: no document"}}'
+      echo "stub-dol-write.sh: HTTP 404 on GET ${ENDPOINT}" >&2
+      exit 1
+    fi
+    ;;
+  "POST /documents/upload")
+    printf '%s' "${BODY}" > "${STATE}/upload_body.json"
+    python3 - "${STATE}/upload_body.json" <<'PY'
+import json, sys
+print(json.dumps(json.load(open(sys.argv[1])).get("filename")))
+PY
+    ;;
   POST\ *"/validate")
     printf '%s\n' "${ENDPOINT}" > "${STATE}/validated_endpoint"
     echo '{"success":1}'