feat(upload): assemble raw counts/TPM/metadata into an h5ad inside the gate

fix(uploads): make the deployed malware-scan posture explicit and honest

style: apply ruff lint --fix + ruff format across the tree

feat(uploads): local content scan + manifest drafting (ADR-0011)