Verify external assets without forwarding Gitea credentials

docs/roadmap/remediation.md

@@ -259,6 +259,8 @@ repository parents and confirm clean worktrees. Affected suites pass.
 
 ### R7 — Medium: Attachment origin restrictions exceed credential isolation
 
+Status: Resolved.
+
 Category: Inadvertently strengthened prohibition.
 
 **Evidence:** [downloadHash](../../internal/gitea/assets.go), around lines 164
@@ -281,6 +283,12 @@ network-policy framework.
 conflicting bytes rejected. Direct and redirected external requests never
 carry the Gitea token; same-origin authenticated downloads continue to work.
 
+**Resolution:** Attachment URLs and redirects may cross origins; the client
+sets the Gitea token only on requests to its configured origin. HTTP tests
+verify direct and redirected external matches, conflicting external bytes,
+absence of authorization on external requests, and continued same-origin
+authentication. The Gitea suite passes.
+
 ### R8 — Medium: The release wrapper collapses documented exit codes
 
 Category: Executable integration and documentation correctness.