GCS integration: run down signed urls

[pefontana]

Run-down integration: support for downloading and uploading GCS checkpoints using signed URLs provided by the run-down service.

Instead of requiring each client to have GCS credentials, clients now authenticate to therun-down service using their Solana wallet signature and receive time-limited signed URLs for GCS operations. This applies to both model download (during warmup) and checkpoint upload (during cooldown).

Request format

Both upload and download requests are POST to {base_url}/upload/{run_id} or {base_url}download/{run_id} with:

{
  "walletAddress": "<solana pubkey>",
  "filename": "model-00001-of-00004.safetensors",  // upload only
  "expiresInSeconds": 3600,
  "nonce": "1772661159000"
}

Header: X-Solana-Signature:
The signature is over: nous-run-down-service:{run_id}:{wallet_address}:{expiresInSeconds}:{nonce}
The run-down service should:

1. Reconstruct the message from the body fields
2. Verify the signature using the provided walletAddress
3. Check the wallet is authorized for the run
4. Return signed GCS URL(s)
5. Optional but good to have: see that the message is not repetead (nonce) to avoid duplicate attacks

Cache

Downloaded files are cached in ~/.cache/psyche/gcs/{run_id}/step-{step}-{manifest_generation}