fix(pages): support existing direct-upload projects

[hseshadr]

Why

AML Filter uses a legitimate Cloudflare Pages Direct Upload project (source: null). The shared provider treated that already-safe terminal state as a foreign binding and stopped before upload.

What

• accept only an explicitly present source: null after exact project/branch/domain validation
• skip the Git-disable PATCH for Direct Upload projects
• fresh-read immediately before upload and require the same project ID, exact domain set, and unchanged source mode
• preserve the existing exact Git owner/repo/branch path with one PATCH and disabled production/preview checks
• fail closed on missing source fields and null↔Git mode flips

Proof

• provider gate: 120 passed, 94.13% coverage
• root compatibility: 210 passed, 96.38% coverage
• real TLS Dagger mock passed
• Ruff, strict mypy, Xenon A, schema, and audit green
• independent review: Ready, no findings