EvidenceBundleAttachment

One file inside an evidence bundle's attachments/ tree (a screenshot PNG or a captured request/ response body).

sizeBytes is metadata-only -- the size the attachment was recorded at when it was written to storage. EventExportWriter gates the whole bundle on sizeBytes before ever calling open, so a full tray of screenshots never has to be pulled into heap just to discover the export was going to be refused anyway. open reads the attachment's actual bytes lazily, once, right before it is streamed into the ZIP; the writer never holds more than one attachment's bytes at a time.

redactionApplicability travels into manifest.json verbatim so a screenshot is visibly marked unredacted rather than silently indistinguishable from a redacted text body. null means the caller could not determine it (the metadata read failed, or the record is gone) -- the manifest must then report no redaction claim at all, never guess APPLIED.