Harden runtime HTTP transport lifecycles

src/__Libraries/StellaOps.Artifact.Core/Api/ArtifactController.FetchHttp.cs

@@ -16,8 +16,7 @@ public sealed partial class ArtifactController
     {
         _logger.LogDebug("Fetching from HTTP: {Uri}", uri);
 
-        using var httpClient = new HttpClient();
-        httpClient.Timeout = TimeSpan.FromSeconds(30);
+        var httpClient = _httpClientFactory?.CreateClient(HttpFetchClientName) ?? SharedHttpFetchClient;
 
         try
         {

src/__Libraries/StellaOps.Artifact.Core/Api/ArtifactController.cs

@@ -9,6 +9,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using StellaOps.Artifact.Core;
+using System.Net.Http;
 
 namespace StellaOps.Artifact.Api;
 
@@ -22,15 +23,23 @@ namespace StellaOps.Artifact.Api;
 public sealed partial class ArtifactController : ControllerBase
 {
     private const string GetArtifactActionName = "GetArtifact";
+    private const string HttpFetchClientName = "ArtifactController.FetchHttp";
+    private static readonly HttpClient SharedHttpFetchClient = new()
+    {
+        Timeout = TimeSpan.FromSeconds(30)
+    };
 
     private readonly IArtifactStore _artifactStore;
+    private readonly IHttpClientFactory? _httpClientFactory;
     private readonly ILogger<ArtifactController> _logger;
 
     public ArtifactController(
         IArtifactStore artifactStore,
-        ILogger<ArtifactController> logger)
+        ILogger<ArtifactController> logger,
+        IHttpClientFactory? httpClientFactory = null)
     {
         _artifactStore = artifactStore ?? throw new ArgumentNullException(nameof(artifactStore));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _httpClientFactory = httpClientFactory;
     }
 }

src/__Libraries/StellaOps.Artifact.Core/TASKS.md

@@ -4,5 +4,6 @@ Source of truth: `docs/implplan/SPRINT_20260130_002_Tools_csproj_remediation_sol
 
 | Task ID | Status | Notes |
 | --- | --- | --- |
+| SPRINT_20260405_011-XPORT-HTTP | DONE | `docs/implplan/SPRINT_20260405_011___Libraries_transport_pooling_and_attribution_hardening.md`: artifact HTTP fetch path now prefers factory-backed clients and uses a shared fallback instead of allocating per request. |
 | REMED-05 | DONE | Remediation checklist: docs/implplan/audits/csproj-standards/remediation/checklists/src/__Libraries/StellaOps.Artifact.Core/StellaOps.Artifact.Core.md. Tests: `dotnet test src/__Libraries/StellaOps.Artifact.Core.Tests/StellaOps.Artifact.Core.Tests.csproj` (23 tests, MTP0001 warning). |
 | REMED-06 | DONE | SOLID review notes captured for SPRINT_20260130_002. |