Build the attachment upload client with httpclient.New

The presigned PUT now uses the shared constructor, which keeps the HTTPS-downgrade redirect policy. The agent guidance also says never to remove an attachment, or pass --force, unless the user asks.