refactor(support): repair attachments and employee assistance access ## Changes Fix attachment uploads failing with "Failed to fetch" by allowing the signed PUT's create-only header in the docs-bucket CORS rule. The deployment probe checks every header the browser sends. Allow active employees to search and select taxpayers in Butuh Bantuan without linking their own accounts to those taxpayers. Preserve payment-code ownership, private case ownership, and current eligibility checks for replies, attachments, and notifications. Ordinary taxpayer accounts still require an exact registration link. Serialize CI browser validation with the existing shared build lock. Allow one fresh-browser restart for a trusted unanswered initial `Page.navigate` command timeout. After merging production, the existing ten-second command deadline fires before its thirty-second document-load barrier. Restart eligibility requires the initial mobile navigation, no other pending commands or resource requests, a live browser, successful owned cleanup, and no cancellation or resource failure. Every route and viewport is inspected again. Transport and navigation failures share the same two-attempt limit. Acknowledged navigation without a load event remains fatal; both production deadlines remain unchanged. Resolves #1732. Resolves #1733. ## Release impact Patch. Repairs and extends the existing payment assistance workflow and its verification without introducing a distinct application capability. ## Migration notes No production schema migration is required. The SQL fixture changes support regression coverage only. Before deployment, a bucket administrator must merge the updated `deploy/gcs-cors.json` rule into the live docs bucket, preserving other applications' rules. This PR does not apply that configuration. The deployment check requires `x-goog-if-generation-match`. Rolling back the app can hide employee-created cases from employees without taxpayer links. Case records and Admin access remain available. ## Validation - Reproduced the merge interaction with the existing native-browser fixture before adapting the retry diagnostic. - Passed all 12 focused native-browser cases with Chromium 153.0.0, including initial recovery, complete cleanup and route/viewport reinspection, repeated and mixed failures, fatal later-route and acknowledged-navigation timeouts, clipped-heading rejection, isolated font transport, and resource denial. - Passed all 102 protocol/cleanup unit tests, including production's thirty-second document-load barrier and ten-second command deadline, plus all 10 build-lock tests. - Runner-routing audit, syntax checks, PR title policy and `git diff --check` passed. - All required GitHub checks passed on the previous head before this merge. Full CI on the final head remains pending. The application build, support/feedback suites and dev server were not run locally. - Live bucket configuration and browser uploads remain unverified.