feat(write-skill): GED attach op — upload the source document onto its invoice (erp#43)

document-attach.sh uploads a source piece (the supplier's own PDF) onto an
invoice's GED via POST /documents/upload — idempotent by (object, filename,
sha256): before any POST the object's GED is listed and a same-named entry is
downloaded back and sha256-compared. Identical → deduped no-op; different
content → ABORT (refuse-never-repair, overwriteifexists always 0, never
Dolibarr's overwrite flag). Read-back after upload: re-list + download +
sha256-verify. Module-relative download paths are derived from the listing's
fullname (supplier invoices carry an id-derived get_exdir prefix like
9/2/FAF2026013/…, so reconstruction would be wrong).

Promote integration: new `attach` op in promote-plan/promote-apply (OP_SCRIPT),
object_id resolvable via @ref and #supplierinvoice lookups; a relative `file`
resolves against the manifest's directory (replay packs carry pdfs/ beside the
manifest, gitignored — README documents the books@ re-fetch message ids).
promote-plan prints each file's sha256 (or a loud MISSING) at review time.
CLI: `arcodange sandbox attach`.

Proof: offline case 12 in tests/run-tests.sh (upload body, dedupe, conflict
abort, field refusal, manifest-relative resolution via stubbed /documents);
live: manifest-C-ged-attach.json applied twice on the sandbox — run 1 four
created, run 2 four deduped, one GED file per FAF2026010-013, stored sha256s
equal to the re-fetched sources; tests/replay-idempotency.sh extended with an
attach op (4 created → 4 deduped, ged_files count unchanged) and a live
same-name/different-bytes abort verified.

Closes erp#43

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRShc4QhLLU73FLHx9vskh

bin/arcodange

@@ -87,6 +87,7 @@ COMMANDS
     invoice                                        Customer/supplier invoice + product/service lines
     payment                                        Record a règlement (transaction_id=bank tx) → bank_transaction_id
     creditnote                                     Create an avoir — customer or supplier (kind)
+    attach                                         Upload a source document onto an invoice (GED; sha256-idempotent)
     accounts                                       List bank accounts (id/label) to pick account_id
     write                <METHOD> <path> [body]    Raw host-guarded write
     checkpoint           status|refresh|provision|relink-env   Manage the iso-prod checkpoint
@@ -287,6 +288,7 @@ EOF
       invoice)    exec "${SKILLS}/dolibarr-sandbox-write/scripts/invoice-create.sh"    "$@" ;;
       payment)    exec "${SKILLS}/dolibarr-sandbox-write/scripts/payment-record.sh"    "$@" ;;
       creditnote) exec "${SKILLS}/dolibarr-sandbox-write/scripts/creditnote-create.sh" "$@" ;;
+      attach)     exec "${SKILLS}/dolibarr-sandbox-write/scripts/document-attach.sh"   "$@" ;;
       accounts)   exec "${SKILLS}/dolibarr-sandbox-write/scripts/bank-accounts.sh"     "$@" ;;
       write)      exec "${SKILLS}/dolibarr-sandbox-write/scripts/dol-write.sh"          "$@" ;;
       checkpoint)
@@ -327,6 +329,8 @@ Each subcommand reads a JSON object on stdin (or a file path arg).
                echo '{"invoice_id":19,"mode":"VIR","account_id":1}' | arcodange sandbox payment
   creditnote   avoir (credit note) referencing a source invoice
                echo '{"socid":42,"source_invoice":19,"validate":true,"lines":[...]}' | arcodange sandbox creditnote
+  attach       upload a source document onto an invoice's GED (idempotent by sha256)
+               echo '{"modulepart":"facture_fournisseur","ref":"FAF2026013","file":"F1045.pdf"}' | arcodange sandbox attach
   write        raw host-guarded write   arcodange sandbox write POST /thirdparties '{"name":".."}'
   checkpoint   manage the iso-prod checkpoint (status|refresh|provision|relink-env)
                arcodange sandbox checkpoint status