process-attachments.sh: release asset on a private repo downloads as 404 (unauthenticated fetch) (sister concern from kiki830621/educator#221)

[kiki830621]

Problem

Observed while running /idd-diagnose #221 in a private repo (kiki830621/educator, ADMIN):

IDD_CALLER=idd-diagnose bash scripts/process-attachments.sh download 221
⚠ Failed to download https://github.com/kiki830621/educator/releases/download/attachments/issue_221_supplement_figure_overflow.png
✓ Manifest: .claude/.idd/attachments/issue-221/_manifest.json

The asset had been uploaded seconds earlier by /idd-issue Step 4 (gh release upload … --clobber) and is visible in gh release view attachments --json assets. The download step appears to fetch the releases/download/... URL without GitHub auth; on a private repo that URL answers 404 for anonymous requests (GitHub does not distinguish 404/403 there), so every attachment on a private repo fails while the manifest records an error and the diagnose proceeds without the image.

Type

bug

Expected

Attachments uploaded by idd-issue to the repo's attachments release are downloadable by idd-diagnose / idd-implement on private repos too — e.g. via gh release download <tag> --pattern <name> -R owner/repo or gh api with the asset id (both authenticated), falling back to plain HTTP only for public repos.

Actual

Anonymous HTTP fetch → 404 on private repos → manifest error entry, image not parsed. Public repos unaffected.

Impact

On private repos (the common case for this user's projects) the Step 1.5 "download attachments" contract silently degrades to "no attachments" — the diagnose had to use a locally staged copy of the screenshot instead.

Source: surfaced during /idd-implement kiki830621/educator#221 reproduction (Step 5.7 sister bug sweep)