Add safe and selective backfill mode to changelog upload

[cotti]

Summary

Delivers the upload-path prerequisites for the release-notes backfill (items 1–3 of the epic's "Current system and prerequisites"): changelog upload --backfill now provides explicit file selection, create-only bundle writes, and strict registry failure semantics.

• Explicit selection (ChangelogUploadService): in backfill mode the operator supplies the exact bundle YAMLs via --files (comma-separated paths or a newline-delimited path list file, aligned with changelog bundle --files); there is no directory globbing. A selected file that cannot be mapped to a destination — missing, no products, invalid product — is an error that aborts the run before any write, never a silent skip.
• Create-only writes (S3IncrementalUploader): a new S3WritePolicy.CreateOnly writes bundle objects with a conditional PUT (If-None-Match: *). Identical remote content → skip (reported as such); different content → conflict, surfaced per key, never an overwrite. The ETag pre-check (existing S3EtagCalculator) is informative only — the conditional PUT is the race guard, so a concurrent create between inspection and write surfaces as a conflict (412 PreconditionFailed). There is intentionally no force flag; corrections are a separately approved workflow.
• Registry failure semantics: in backfill mode an unreconciled registry (S3 error or exhausted optimistic-concurrency retries) is an incomplete operation — it emits a clear error and fails the run. Conflicted objects are excluded from the registry refresh so the manifest never records content that is not actually published.

Design notes

• How backfill mode is surfaced: a single --backfill flag switches the mode, with --files as its required selection input. The pairing is validated in ChangelogUploadService (testable regardless of caller): --backfill requires --files and --artifact-type bundle (the backfill publishes bundles only, per the epic), and rejects --skip-etag-check, whose forced re-upload semantics would turn every idempotent re-run into a conflict. --files without --backfill is rejected so live behavior cannot drift.
• Why live behavior is untouched: S3WritePolicy defaults to Overwrite and the create-only path is only reachable via args.Backfill; without the flag, discovery, overwrite, and best-effort registry refresh are byte-for-byte the previous code paths. Registries keep their existing concurrent conditional-update path (If-Match/If-None-Match + bounded retries) in both modes. Proven by the untouched pre-existing upload tests plus new explicit tests (Upload_DefaultPolicy_DoesNotUseConditionalPut, Upload_Live_RegistryRefreshException_DoesNotFailUpload).
• docs/cli-schema.json regenerated; supplemental docs updated (docs/cli/changelog/cmd-upload.md, docs/development/changelog-bundle-registry.md). Expected to conflict on the schema with the concurrent [Feature Request]: A way to redirect from one page to another just for specific anchors #670 PR — whoever merges second rebases and regenerates.

Test plan

New tests in Elastic.Documentation.Integrations.Tests (uploader) and Elastic.Changelog.Tests (service orchestration), following the existing FakeItEasy IAmazonS3 fake + MockFileSystem patterns:

• Exact selection: unselected files in the same directory are not uploaded; relative paths resolve against the bundle directory; multi-product bundles fan out per product.
• Create-only conflict: existing key with different content → run fails, object untouched, no registry write for the conflicted target.
• Skip on identical content: reported as skip, run succeeds, registry still reconciled.
• Concurrency race: conditional PUT loses (412) → conflict, not overwrite.
• Registry refresh failure (S3 exception and retry exhaustion) fails the backfill operation; the same failure in live mode remains a warning.
• Mode guards: --backfill without --files, with changelog artifact type, or with --skip-etag-check; --files without --backfill; missing selected file and productless selected bundle fail before any write.

Checks run locally: dotnet format clean · ./build.sh build --skip-dirty-check ✓ · AOT publish with zero trim/AOT warnings ✓ · ./build.sh unit-test 4,247 passed / 0 failed ✓ · schema diff empty ✓.

Closes elastic/docs-eng-team#668

[github-actions]

Label error. Requires exactly 1 of: automation, breaking, bug, changelog:skip, chore, ci, dependencies, documentation, enhancement, feature, fix, redesign. Found: