Publish flow

Upload report

The first alpha path accepts a single HTML file. ZIP bundles, screenshots, and scanning jobs are next in the pipeline.

Drop an HTML report

This scaffold shows the intended upload surface. The next implementation step wires this to signed R2 uploads.