Ids and facts, no links: a link is asked for per artifact through
GET /runs/{run_id}/artifacts/{attachment_id}, so reading the list signs nothing and
works on a deployment with no bucket. A user’s upload to the same run is not listed.
Requires the viewer role in the run’s workspace.