feat(release): carry upload-rule ids on domain Release

[ben-miru]

Summary

• Domain Release now carries upload_rule_ids: Vec<UploadRuleID>, populated from the server-side upload_rules expansion. From<backend_client::Release> is replaced with a Release::from_backend(release, upload_rule_ids) constructor, threaded through deserialize via #[serde(default)].
• Re-vendors api/specs/backend/v04.yaml from openapi main to pick up the new getRelease expand param (openapi #167) and regenerates models, adding a ReleaseExpansion model.
• The get-release service now requests the expansion (fetch_release passes &["upload_rules"]) and projects the expanded rule ids onto the Release. If the backend fails to expand, it hard-errors (ServiceErr::UploadRulesNotExpanded) rather than silently caching an empty set that would poison the shared release store — mirroring the deployment-sync path.
• Deployment sync (store_expanded_release) links the ids onto the stored Release, while still writing full rule bodies into the separate append-only upload_rules store.

Split out of the in-progress uploads branch (#93) so it can be reviewed and merged independently; this should merge before #93. The uploader-feeding work (active-rule traversal + syncer push) intentionally stays on #93.

Validation: cargo check --workspace clean; full test suite green (1349 passing); preflight clean; separate lint gate clean.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}