A preview URL for one tenant's asset, claiming another tenant

A preview URL for one tenant's asset, claiming another tenant Found by decoding a token the running dev stack had just minted, as a check that the v4 format worked end to end. It did. It also asserted that an asset in `initech` belonged to `acme`. `sign_preview` stamped `DeliveryState::tenant_id` into the claim — whichever tenant *this process* was configured to deliver for — rather than the tenant that owns the asset. Identical whenever those are the same, and they are in every deployment delivery currently supports. They diverge in a shape the API already allows: one process answering the asset endpoints for every tenant while delivery serves one. Nothing observable changed, and that is the point. A claim naming a tenant this process does not serve 404s either way, so the false claim sat in the token harmless and invisible. It stops being harmless the moment G22b resolves the library *from* the claim instead of from configuration, which is the whole direction of travel — so a token minted today that would be wrong then is worth fixing while it is cheap. `sign_preview` takes the owning tenant now; its one call site had `caller.tenant_id` in scope already. The distribution mints reach `issue_with_purpose` from shares, portals, oembed and downloads, each knowing a tenant by a different route, so threading it through those belongs with G22b rather than ahead of it. That line now says so rather than looking like it was considered and chosen.