cfl attachment download returns HTTP 401 on every branch

[rianjs]

What happened

cfl attachment download <id> fails with Error: downloading attachment: downloading attachment: status 401 on every code path that actually attempts to fetch bytes. Observed against monitproduct.atlassian.net with basic auth (API token from keyring).

Reproduction

Using a freshly-uploaded attachment on a sandbox page:

$ cfl attachment upload -p 3517808642 -f test-att.txt
✓ Uploaded: test-att.txt
ID: att3518038017

$ cfl attachment download att3518038017
Error: downloading attachment: downloading attachment: status 401

$ cfl attachment download att3518038017 -O downloaded-custom.bin
Error: downloading attachment: downloading attachment: status 401

$ cfl attachment download att3518038017 -O downloaded-custom.bin --force
Error: downloading attachment: downloading attachment: status 401

Notes

• Same auth works for attachment list -p <pageId> and the underlying GetAttachment metadata call (the error message itself only appears after the metadata GET succeeds, so the JSON-API auth is fine).
• The filesystem precheck still works: when the default-name target file already exists locally, the precheck error fires before the network call (file already exists: ... (use --force to overwrite)).
• The success branches (default filename, -O, --force overwrite) cannot currently be observed — they all hit the 401.

Discovered during evidence-backed surface inventory; raw captures in /tmp/cfl-outputs-60314/raw/attachment.download.*.txt.

cfl version: 1.0.47 (commit 16e7373)