Artifact fetch responses are screened before the auth-error branch

Both artifact fetch paths now run the raw status, headers and body through a shared screening step that can stop the fetch early with a canned message. It runs only for direct fetches and is skipped when the request goes through the cloud relay. The screening code and its map from reason to message live in a shared chunk, so which responses it rejects is not visible from the fetch paths themselves.