Get a signed URL for one of a test run's own artifacts

Returns a short-lived signed URL for a single artifact belonging to this test run, identified by a key relative to the run's workspace bucket.

The workspace, and therefore the bucket, is derived server-side from the test run. The caller never supplies or learns a bucket name, and object_key is required to fall within this run's own artifact prefix, so the endpoint cannot be used to reach an unrelated object even inside the same workspace. This is the run-scoped counterpart to getArtifactUrl, which instead parses the workspace out of a client-supplied absolute path.