get_media_render_download

Get a same-origin bearer download path for one completed, available render output. GET this path under the same Qraft /api/v1 origin with the Authorization header; never put tokens in URLs. Pins render attempt and SHA-256; live editor/read grant is rechecked at download time. Response is MP4 bytes, full download only, no Range. Stream to a file and verify byte count/hash. No render start, import, storage key, provider token or signed credential URL. Older workers refuse.