feat(bsk): fix upload function that cannot bypass layout

crates/bsk-protocol/schema/tool_download_params.json

@@ -6,6 +6,13 @@
     "session_id"
   ],
   "properties": {
+    "browser_relative_dir": {
+      "description": "Daemon-injected relative directory beneath Chrome's Downloads root.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
     "ref": {
       "type": [
         "string",
@@ -21,13 +28,6 @@
     "session_id": {
       "type": "string"
     },
-    "staging_path": {
-      "description": "Daemon-injected destination directory for the browser process.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
     "tab_id": {
       "type": [
         "integer",