Fix three bugs, and raise coverage from 72% to 88%

[gmpassos]

Three bugs, found by putting the untested paths under test — and the tests that found them.

Bugs fixed

1. A rejected relay upload deadlocked the caller

attachAsset is rejected before it subscribes to the chunk stream for a duplicate name, an unknown release, or an unsafe filename. Nothing was then listening to that stream, so the upload session's close() could never complete and commit hung until the caller's RPC timeout — 30 seconds to deliver a ConflictException that was decided immediately.

Worse, the session kept accepting chunks into the dead controller, so a multi-gigabyte artifact was buffered in memory on its way to an error already settled.

The session now records the rejection, fails the next chunk fast, and stops awaiting a close that cannot happen.

2. S3 never recorded the SHA-256, so head always reported null

_checksumHeaderOf documented reading the digest back from x-amz-meta-sha256, but nothing ever wrote it — while GCS did record it via a metadata patch. Two backends, same operation, different results.

The digest is now attached whenever it is known before the request is sent: always for a buffered body, and for a streamed one when the caller declared it. S3 headers precede the body and S3 has no metadata-only update, so the one remaining case is documented on head rather than paid for with a server-side COPY on every upload.

3. The server and node banners bypassed the injected output sinks

Both wrote to stdout directly, so --quiet could not suppress them and an embedding tool could not capture them — despite the CLI being documented as driveable in-process with injected sinks. Both now take the sink the runner already has.

Coverage: 72.4% → 88.2% (413 → 707 tests)

Added	Why it earns its place
Fake S3 + fake GCS speaking the real wire protocol	The shared ObjectStorage contract now runs against both cloud backends as well as memory and local disk — six configurations. Signed requests, XML/JSON responses, ranges, pagination. This surfaced bug 2; a stub returning canned bytes would only have proved the methods exist.
OmnyStoreApi conformance suite	The same 35 scenarios against all four implementations: embedded, hub over a local provider, hub over a remote node across the RPC protocol, and the client over a real socket. Tests the central design claim directly. This surfaced bug 1.
Real-socket omnystore server / node tests	The commands an operator actually runs, and the ones a unit test cannot reach. This surfaced bug 3.
Auth providers, API error rendering	Small units that were near-uncovered; now complete, including that an unhandled exception's message never leaks into a response.
Multi-architecture tests	One release carrying five os-arch builds; an updater always resolving its own, and never being handed another's.

Lowest-covered files went from s3_object_storage.dart at 18.8% and server_commands.dart at 16.8% to 88%+ and 80% respectively.

Also

Documented the multi-architecture model in doc/workflows.md — one release, many os-arch artifacts, exact matching, and what isInstallable means when a matrix runner drops a build.

Verification

dart format, dart analyze --fatal-infos --fatal-warnings, 707 tests, dart pub publish --dry-run (0 warnings) — all green.

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️