GET /api/artifacts/:filename with filename validation (no path components, no dotfiles). Sleds only ever download binaries from their own gateway; this endpoint is where the gateway serves them from, replacing the current_exe()-based /api/huskies-binary which serves the gateway's own (macOS) binary — wrong platform for Linux sleds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fHdm92yjvguPi2LiXfLB9