There is no valid scenario where a snapshot uploaded as part of a PR
should lack a base SHA — without it, the server cannot identify which
base build to compare against. Previously this was silently accepted,
leading to orphaned "solo" snapshots that could never produce diffs.

This adds client-side validation that bails early with an actionable
error message before any images are uploaded or API calls are made. The
error points users to either pass `--base-sha` explicitly or ensure
their CI environment exposes the merge base.

Companion to getsentry/sentry#115446, getsentry/sentry#115448, and
getsentry/sentry#115460 which handle the server/UI side of base-build
edge cases.

…ore (#3305)

Uses the new batch HEAD operation added in
[objectstore#478](getsentry/objectstore#478) to
check which images already exist before uploading. Since image keys are
content-addressed (SHA-256 hash), unchanged images between runs produce
the same key and don't need re-uploading.

**How it works:**
- After hashing all images, batch HEAD all keys via `session.many()` to
check existence
- Only batch PUT images where HEAD returned 404 (not found)
- HEAD errors are treated as "doesn't exist" — safe fallback that just
re-uploads

**Performance with 40k images:**
- First upload (all new): ~33 minutes
- Second upload (all cached): ~4.5 minutes (~7.5x faster)

Bumps `objectstore-client` from 0.1.6 to 0.1.9 and adds `futures-util`
for `StreamExt::next()` on the HEAD results stream.

Note: the objectstore expiration policy is still TTL. Once it's changed
to TTI, the HEAD requests will also bump expiration timers, preventing
frequently-used images from expiring.

This PR contains the following commits, which are ported from a private
repo

-
[`e344276`](e344276):
changelog update
-
[`f585427`](f585427):
getsentry/sentry-cli-security-fixes#13
-
[`29fe087`](29fe087):
getsentry/sentry-cli-security-fixes#22
-
[`36d24c2`](36d24c2):
getsentry/sentry-cli-security-fixes#18
-
[`dc2c943`](dc2c943):
getsentry/sentry-cli-security-fixes#19
-
[`1e31ca8`](1e31ca8):
getsentry/sentry-cli-security-fixes#21
-
[`769b8ce`](769b8ce):
getsentry/sentry-cli-security-fixes#11

#skip-changelog