Dispatcher presigned URL generation

[nishu-builder]

Generate presigned URLs in dispatcher when EVAL_S3_BUCKET configured.

[nishu-builder]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Local testing with LocalStack #4949
• Watcher S3 result reading #4948
• Dispatcher presigned URL generation #4947 👈 (View in Graphite)
• Episode runner presigned URL support #4946
• S3 presigned URL utilities #4945
• Job runner cross-account: implementation plan #4944
• Update job runner spec with cross-account architecture design #4904
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• add-to-merge-queue - adds this PR to the back of the merge queue
• add-to-merge-queue-as-hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acff8976e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve policy_uris when building presigned spec

When EVAL_S3_BUCKET is set, the uploaded spec replaces the job’s policy_uris with urls["policy_uris"], but policy_s3_paths is currently initialized as an empty list in this branch. That means any job that originally had policy URIs will be serialized with an empty policy_uris, and PureSingleEpisodeJob validation will fail because assignments must be within the policy range. This breaks all presigned runs that have non-empty policies; you likely need to derive policy_s3_paths from job_spec["policy_uris"] (or fall back to the original list) before overwriting the spec.

Useful? React with 👍 / 👎.