Stage model artifacts without copying broad cloud credentials
When a private model checkpoint must move between hosting systems, keep broad control-plane credentials off the destination worker. Download the artifact through a trusted control machine, record a content hash, upload only the model files, and verify the same hash at the destina…