Function persist_content_addressed 

pub fn persist_content_addressed(
    workspace_dir: &Path,
    bytes: &[u8],
    ext: &str,
) -> Result<PathBuf, EmbeddedResourceError>

Persist bytes as a content-addressed file <sha256>.<safe-ext> under {workspace}/uploads/ and return its absolute on-disk path. This is the single hardened persistence substrate shared by ACP/MCP blob intake, outbound deliver_file, and the RPC attachment writer.

Every filesystem operation is bound to a directory handle opened once ([cap_std::fs::Dir], beneath/no-follow semantics): the uploads handle is resolved a single time, and temp creation, rename, dedup reads, and the final install all go through that handle rather than re-resolving a pathname. A directory or symlink swapped in after the handle is opened therefore cannot redirect any write or read outside the workspace — closing the check/act window a post-write canonicalize could only detect after the fact.

The on-disk name is the full-digest content hash (never a caller-supplied filename), a symlink pre-planted at the destination is dropped (not followed), dedup verifies bytes rather than trusting a length match, and the input is size-capped.