Resolve a runtime download URL

Resolves a runtime limulator download URL into the internal download bundle shape. URLs that point at Limrun-owned asset-storage buckets may be upgraded to a header-signed TAG request with the original URL as fallback, but only after the original URL successfully authorizes a one-byte probe. Other URLs are returned unchanged. Possession of the source URL is the authorization capability for this endpoint.