Bind scoped blob URLs to an exact record CID

[ascorbic]

Problem

Scoped blob URLs currently identify a record by DID, collection, and rkey:

/r/{did}/{collection}/{rkey}/{blobCid}
/img/{preset}/r/{did}/{collection}/{rkey}/{blobCid}[@format]

Admission fetches the current record and checks that it references blobCid. The Record entrypoint already returns the current record CID, but scoped admission does not compare it with a caller-selected revision.

This makes the route describe “whatever record is current at this key” rather than the exact record revision that authorized the blob. A client holding an aggregator view for record CID A cannot bind its cache request to A after the rkey has moved to record CID B. Jetstream purging narrows the cache window, but the URL and admission contract remain revision-ambiguous.

Proposed change

Include the repository record CID in scoped blob and image routes:

/r/{did}/{collection}/{rkey}/{recordCid}/{blobCid}
/img/{preset}/r/{did}/{collection}/{rkey}/{recordCid}/{blobCid}[@format]

During admission:

1. Fetch the record as today.
2. Require RecordInfo.cid === recordCid.
3. Require RecordInfo.blobs to contain blobCid.
4. Admit and cache only when both checks pass.

The record CID needs its own validation because repository record CIDs use DAG-CBOR, while blob CIDs use the raw codec.

Acceptance criteria

• Scoped raw and image routes include recordCid in their canonical path and cache key.
• A matching record CID and referenced blob CID are admitted.
• A mismatched record CID is denied even when the current record references the requested blob.
• A matching record CID is denied when the record does not reference the blob.
• Record update/delete purges continue to clear every revision URL via the existing record tag.
• The README and deployed HTTP tests document the new route.

Backward compatibility for the old scoped route is not required. Returning 404 for the revision-ambiguous form is preferable to redirecting it to whichever revision happens to be current.