8e870de9d7
Spec review (live negative test) found s3-request-presigner unconditionally unsigns content-type: header-less PUT returns 200, so the previous docblock claiming signature enforcement was a false guarantee. Content-Type is now documented as convention-only; head() returns contentType so the complete step (Task 19) can verify it server-side against the session declaration. Co-Authored-By: Claude Code <noreply@anthropic.com>