Function materialize_bytes 

pub fn materialize_bytes(
    workspace_dir: &Path,
    bytes: &[u8],
    filename: &str,
    mime: &str,
) -> Result<MaterializedResource, EmbeddedResourceError>

Persist already-read bytes as a content-addressed file under {workspace}/uploads/<sha16>.<safe-ext> and return where it landed. The on-disk name is the content hash (never a caller-supplied filename), the write is no-follow (symlinks at the destination are dropped, not followed), confinement is checked before the write and re-verified after it, and the input is size-capped. filename/mime are display metadata only. Used by both inbound blob intake and outbound deliver_file, so ACP consumers can read this workspace-internal, content-named copy rather than re-opening a caller-supplied path.