fix: close inbound hold bypass paths

scripts/synchronous-dependency-baseline.mjs

@@ -55,6 +55,8 @@ export const SYNCHRONOUS_CLIENTS = Object.freeze([
     'firstleg-service', 'event-bridge-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', '装柜/船节点 Outbox 按 eventId 投递'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/FeePaymentVoucherFileClient.java',
     'firstleg-service', 'file-service', ['REQUEST'], 'READ', 'SAFE_READ', '校验付款凭证元数据'),
+  feign('firstleg/src/main/java/com/baiyue/firstleg/client/InboundHoldFileClient.java',
+    'firstleg-service', 'file-service', ['REQUEST'], 'READ_WRITE', 'MIXED', '扣货凭证上传无幂等键，元数据与下载可重复'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/FinanceFeeSourceEventClient.java',
     'firstleg-service', 'finance-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', '费用 Outbox 按事件幂等键投递'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/IamCustomerSnapshotClient.java',