File-upload mappings need staging; card logos need explicit slots

An upload integration incorrectly treated file-uploadable inputs as local path strings, while its SDK default required a staged name/mimetype/s3key descriptor. Resolve the declared file field from the pinned schema, validate non-file args first, stage the exact approved local file through the SDK, validate the descriptor, then execute the write once. Separately, a custom card without the widget kit identity marker received an automatic absolute logo over its status icon; adding an explicit in-flow identity slot and separate status group fixed it. Replace path-string fake schemas with descriptor fixtures and test binary bytes, cancellation during staging, and actual browser logo geometry.