Get presigned upload URLs for checkpoint sync (two-tier).
Returns:
The HEAD bundle is keyed by SHA for deduplication - if it already exists, head_url will be null to skip the upload.
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Successful Response