Put media in change sets and add the media tools #2544

Part of #2427 (F-MED). Next slice after media assets (#2542): uploads and metadata changes become change set operations that are diffed, published and reverted like entries. Agents get tools to upload, describe, list and read media, and to attach an asset to a field (MED-03, CHG-01).

Scope

• Change sets (ChangeSetDirectory): a media operation points at an asset of the site and at stored versions of it. Each change_set.operation_added event carries its base version's row.
  • Diff: the version's metadata compared field by field (file name, folder, tags, alt text, caption); a change of the bytes shows as properties (content type, length, SHA-256).
  • Publish moves the asset's published version from the operation's base to its proposed version, with the same stale-base checks as entries; a delete unpublishes. Events: media.published and media.unpublished.
  • Revert restores the earlier published version through the same publish.
• Agent permissions: IAgentPermissions.CheckMediaAsync(operation). Media is not a content type, so an agent's scope allows media by its operations (read, create, update, delete) and its sites, whatever types it lists (MCP-05).
• Core (FluentCMS.Core.Builtin.Tools): MediaTools, with
  • upload_media: base64 bytes, content type and metadata. It stores version 1 and adds the create to a change set in the same call.
  • update_media: new metadata from a base version, as an update in a change set.
  • get_media and list_media: reads, by folder and tag.
  • attach_media: sets a media field of an entry to an asset, or adds it to a list of media; on an entity it keeps the fact's metadata. It proposes the entry update like update_entry.
• Writes commit the version and its operation together or not at all, as the entry tools do, so no version an agent writes exists outside a reviewed set.
• The MED row of McpCoverageTests lists the tools.

Out of scope

• The "alt text required" check: the next slice.
• Soft delete and restore of assets: the last slice.
• Fetching media from a URL (outbound access is allow-listed per SEC-05, later), and the library screen.

Acceptance

• S2 over MCP, as far as media goes: an agent uploads a product image without alt text and attaches it to a product page in one set. The set holds the media create and the entry create with the agent as initiator. A person publishes it, and the asset and the page are published.
• A metadata update proposes an update whose diff shows the changed alt text; reverting it restores the earlier published version.
• A stale base or a deleted asset fails the publish and moves nothing; a failure at any audit append of a publish moves nothing.
• An agent without the create operation cannot upload; an agent scoped to some types can still upload.
• Every tool passes ToolProviderConformanceTests and the MCP-01 coverage test.
• Everything above passes on SQLite and PostgreSQL, with no new package.

It changes ChangeSetDirectory and calls CreateAsync in tests, so it merges after SCH-05 (#2520) and #2542.