- config: require an https GCS endpoint and HMAC credentials when signed URLs
are enabled, and reject combining them with STS assume role (alongside the
existing GCS IAM auth check).
- s3 store: build the presign client once and reuse it across Sign() calls.
- changes: note bootstrap package downloads are covered too.
- tests: assert the presigned URL shape and cover the STS assume-role rejection.
Carlo DiCelico
a5101d796f