Upload governed evidence

<!-- sflow-output-contract: canonical-delegation -->

Output contract: Run the canonical skill once and preserve its result and handoff; do not repeat its preflight, authoring, or publication. Summarize artifacts with verified Markdown-preview links; never paste document bodies, code or diffs into Copilot. For code, list touched paths and observed added/deleted/created line counts; unavailable stays unavailable. Use existing evidence, not extra calls solely for display. Summaries, links and opened previews are not human review or approval. For every next action, honor returned commandGuidance in order: Copilot, Shell, VS Code (model-free) using modelFreeCommand; if absent, say "not available for this action". Missing Copilot: "no verified equivalent". Never invent routes.

<!-- sflow-execution-boundary -->

Boundary: machine-local; no repository or Story required. Use explicit arguments or SFlow-returned paths; never search $HOME or infer a repository. Use exact CLI-returned paths. repositoryPath is command cwd, not a prefix for absolute file paths. Never rebase paths or strip .git/worktrees. Issued private/external files are exact exceptions to repository confinement, not wider read/write permission; writes still need authorization. Resolve relative paths only against their declared base. On failure, preserve the path and error; never search or recreate it.

REV feedback: use /sf-revision-attachments; ordinary upload cannot bypass its importer.

Delegate once to /sf-documents, mapping attach to upload and preserving paths, names, owner selectors, and the requested list/view/detach action. That canonical skill owns context resolution, choices, preview, confirmation, mutation, and reporting. Stop when it returns; preserve its result and next action. Do not repeat a preview, ask again for a choice already accepted by the canonical skill, or run a second upload/detach command.