*/
export function buildCLIDownloadUrl(os: string, arch: string, quality: string, commit?: string): string {
const artifact = `cli-${os}-${arch}`;
if (commit) {
// Defense-in-depth: same validation as getRemoteCLIBin so the URL
// can never be formed with a non-SHA commit (would 404) and stays