CI artifacts

Workflow files and test reports use the private Cloudflare R2 bucket hc-ci-artifacts, not GitHub's native artifact service. Archives and completion manifests live under <retention>d/hidden-claw/bloom-ai/runs/<run-id>/<attempt>/<artifact-name>. Run summaries contain locators. Preview handoffs expire after 1 day, reports after 7 days, and tested-tree markers after 14 days; R2 lifecycle deletion is asynchronous. Artifacts do not appear in GitHub's native Artifacts list.

The shared actions and retrieval instructions are pinned to a reviewed commit. Repository Actions secrets provide object-only access to this bucket; they cannot access public media, source documents or backup buckets. Repository Actions variables configure the bucket and S3 endpoint. Organization-level copies are also selected for these repositories, but private repositories on GitHub Free use the repository-level settings. Fork PRs receive no secrets and cannot upload optional reports; required downloads fail without credentials. Never use pull_request_target to run untrusted code with storage credentials.

Use authenticated S3 access or the shared download helper to retrieve an archive. Do not publish the bucket or paste access keys, preview credentials, or signed download links into logs or summaries. GitHub Actions caches, GitHub Releases, container images, and deployment services remain unchanged.