Confine publish archive reads

internal/adapters/storage/object_store.go

@@ -2,9 +2,16 @@ package storage
 
 import (
 	"context"
+	"io"
 	"time"
 )
 
+// ReaderUploader streams caller-owned, already-opened content to object storage.
+// Callers retain source-selection and filesystem-confinement policy.
+type ReaderUploader interface {
+	UploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions) (ObjectInfo, error)
+}
+
 // ObjectStore is a remote object storage boundary used by prepare, restore, and publish work.
 //
 // Key invariant: