Direct-presign deploy — bytes never touched our API server