Use built-in COS upload verification

[tiye]

Summary

• switch COS upload from v1.0.0 plus a copied remote verifier to v1.1.1 built-in full-file public verification
• keep the project verifier focused on checking local CDN asset references
• upgrade Yarn to 4.18.0 and pin the current workflow actions/tooling
• update remaining Calcit dependencies and migrate the deprecated %some call to the current Option constructor
• retain PR/production rsync deployment and server source deployment

Validation

• client and server Calcit 0.27 check-only succeed
• 20/20 Calcit tests pass
• client and server dynamic-method findings: 0
• client and server deprecated API findings: 0
• Vite 8.2.2 build succeeds and the local verifier confirms both CDN asset references