Mint a signed short-lived URL for a fragment’s bytes

Fragment twin of the asset mint (whole parent-asset bytes, strictest piiClasses union). Same gate ladder as the raw stream; on pass answers a short-lived signed URL token (HMAC-SHA256, EVIDENCE_SIGNED_URL_SECRET, TTL EVIDENCE_SIGNED_URL_TTL_SECONDS, default 300 s) redeemable WITHOUT auth at /v1/evidence/redeem/{token}. 503 while the secret is not configured. 404 until EVIDENCE_RAW_READ_ENABLED=1.

Required scope: brain:read.