publish: upload local files referenced by links, not just images

Start with the forward attachment registration at images.go:78, then read attachname.go and the shared withinRoot clamp. Compare link handling with renderImage and inspect the mapping in docs/confluence/links-and-anchors.md. Done means qualifying local non-.md link targets upload and rewrite correctly, while .md links retain the existing page-URL behavior and inverse ri:attachment rendering is updated via sourceFor.

read/export now pass an attachment link through as raw storage rather than converting it, because a markdown link to the exported file would break on the next publish. From the mapping table in links-and-anchors.md:

So this exports:

Grab <ac:link><ri:attachment ri:filename="Deck.ppt" /><ac:plain-text-link-body>the deck</ac:plain-text-link-body></ac:link>.

where Grab [the deck](Deck.ppt). would read better, preview locally, and reference the file export already downloads (it scans raw storage for ri:filename, not just ac:image, precisely so a link target is included).

What blocks it is the forward path, not the inverse one. Only images.go:78 registers an Attachment, so a local file named by a link destination is never uploaded, and republishing [the deck](Deck.ppt) emits <a href="Deck.ppt"> — a relative href that resolves to nothing on Confluence, with no warning and exit 0. That is the silent failure mode docs/confluence/links-and-anchors.md already calls out for unresolved doc links, and it is worse here because the link was working before the round trip.

The work is therefore in the forward direction first: treat a link destination that names a local non-.md file the way an image src is treated — resolve it page-relative, clamp it to the documentation root, register it as an attachment, and rewrite the href to the attachment. attachname.go's source-path↔attachment-name codec and the withinRoot clamp both already exist and are shared with images; what is missing is a link-side caller. Once a link target uploads, flip ri:attachment in the inverse mapping from passthrough to [body](path) via sourceFor, exactly as renderImage does.

Two things to decide when picking this up. Whether a link to a local file should upload it at all, or only when some marker says so — an unqualified rule means any [x](notes.txt) in a repo starts publishing that file as an attachment, which may be more than anyone asked for. And what .md siblings do, which must keep resolving to page URLs via the existing doc-link path rather than becoming attachments.

Split out of #88, where the passthrough decision was made.