Opens an empty batch job. Items arrive on later upload calls and the set
is sealed at finalize.

Supplying request_id makes the create idempotent on that token: a
retried submit whose response was lost returns the original job rather
than opening a second one. This dedupe is scoped to the calling
credential. A request_id whose job was canceled or failed before it
finalized is released for a fresh replay; once a job is finalized, its
request_id keeps resolving to it even after cancellation.

An instance may hold at most 4 active (pending or processing) jobs at
once; a create past that limit returns 409. The limit is instance-wide
— jobs are shared across the instance's credentials — so another
credential's jobs count against it.