Presigned reads of the workspace members' promoted SCIP artifacts + manifests, for the review worker's cross-repo TRUST chain (issue #210).

Same auth + tenant-derivation guarantees as /peer-graphs (a job token bound to this run PLUS an active lease; the tenant/group/home/base-SHA all read from the AUTHENTICATED run, never from client input). Gated behind BOTH the cross-repo group flag AND a dedicated scip_trust_enabled flag, so it 404s until the gate-capable path is deliberately armed. The service applies the package-collision + base-SHA provenance downgrades before returning anything (see presign_group_scip).