fix: restore public file streaming and contain ZIP failures

[tdurieux]

Public repository files such as PatchScope-1007/README.md return 502 because the API forwards a process-local public-read: handle to a separate streamer. Revalidate public access in the API and send an empty token for anonymous public downloads. Keep owner credentials inside the API and preserve authenticated private downloads. Public ZIPs use codeload directly without consuming the streamer's anonymous REST quota.

Reject file-send promises when access revalidation fails, and default missing or empty commits to HEAD. Handle archive and entry errors so anonymization timeouts abort failed downloads without crashing the streamer.

Validation:

• Full suite in an isolated checkout: 636 passing, 49 pending.
• HTTP integration tests cover both public file streaming paths, missing commits, and credential isolation.
• ZIP tests verify anonymized content, no anonymous REST lookups, and timeout handling.
• ESLint passes for changed files.
• The initial type check reported the same five existing diagnostics on unchanged main and this branch, involving the ES target and Octokit response types.

[tdurieux]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T15:27:16.654158Z	2e6b79b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9c729c2c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tdurieux]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 2e6b79b30d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".