Changes to Sign every hosted file of one artifact in one call: one authorization and one live eligibility re-check for all files. Each URL keeps the single-file lifetime (at most 300 s) and generation pin.