Stream workspace file content (latest version)

Cross-artifact file route. Enforces per-file visibility — private files require owner, workspace member, or a sharee grant.