Mint an on-demand exports:read token for a ready, owned export.

Ownership + readiness are enforced by :func:resolve_export_download (404 on non-owner / not-ready), mirroring the download routes. The scope gate follows them, exactly as on the download routes, so a stranger reads 404 before any 403. The caller must hold exports:read itself: a mint never grants more than the caller already holds, so a snapshots:read or blobs:read download token cannot rotate into this artifact. The plaintext is returned once and never persisted or logged; the token carries the same label the builder's _finalize uses, so the sweeper's existing revocation covers it.

The mint never outlives the caller either, so bounded_expiry holds the token to the earlier of the export's expiry and the caller's own. That also answers the export row whose expires_at is NULL: the token takes the caller's expiry instead of living forever. The clamp is silent, because the request carries no lifetime field. The response reports the token's expiry, which is what governs the download the caller is about to run.