feat(12-01): record multipart uploads and match Winter upload URLs

- attach.PublicURL and (*File).URL build Winter File::getPath() URLs; the
  thumbnailer decodes webp via golang.org/x/image v0.46.0 and checks the
  image size from the header before decoding
- tide requests carry multipart parts (files beside the fixture pinned by
  sha256) encoded with the fixed MultipartBoundary, so PHP and Go receive
  byte-identical bodies
- tide masks the random partition, disk name and file id of url/thumb_url
  upload URLs while still diffing prefix, size, mode and extension, and
  NormalizePublications masks Carbon dates in the published album

modules/tide/record.go

@@ -37,6 +37,10 @@ func RecordFlow(ctx context.Context, spec Flow, cfg RecordConfig) (Flow, error)
 		if err != nil {
 			return Flow{}, fmt.Errorf("tide: record step %s: %w", step.ID, err)
 		}
+		req, err = prepareRequest(req, cfg.BaseDir)
+		if err != nil {
+			return Flow{}, fmt.Errorf("tide: record step %s: %w", step.ID, err)
+		}
 		resp, err := doStep(ctx, client, cfg.Target, req, limit)
 		if err != nil {
 			return Flow{}, fmt.Errorf("tide: record step %s: %w", step.ID, err)