[CI] Secure-file download fails with TF15004 expired request signature

## Failure signature

The Azure DevOps `DownloadSecureFile@1` pre-job fails before checkout or test execution while downloading `macios-certificates-and-provisioning-profiles.zip`:

```text
Error: Failed to download secure file. HTTP 500: Internal Server Error.
TF15004: The download request signature has expired.
```

Stable signature: `tf15004-expired-secure-file-download-request-signature`

## Confirmed occurrences

| PR / head | Azure run, attempt, job, and task | Worker / time (UTC) |
|---|---|---|
| #26523 / `009d29239569f16f51a09943cd8fbed39167fa2a` | [15178528 attempt 1 / `monotouch_maccatalyst` / secure-file pre-job](https://devdiv.visualstudio.com/0bdbc590-a062-4c3f-b0f6-9383f67865ee/_build/results?buildId=15178528&view=logs&j=73408371-a55e-5ff5-5372-c49d56cfe7c2&t=5293f614-d055-44bc-b2b6-34cb7ec717f4) | `AcesShared 78`, 2026-09-02 02:59:08 |
| #26475 / `56d8ad2aa9785bf30a1522852177506bbd03240c` | [15194793 attempt 1 / `dotnettests_multiple` / secure-file pre-job](https://devdiv.visualstudio.com/0bdbc590-a062-4c3f-b0f6-9383f67865ee/_build/results?buildId=15194793&view=logs&j=cd83ae7b-ccd7-56c3-8d2a-f8a5a1c873b0&t=a5ab2d68-e356-4b60-b4b2-b6073558d96a) | `AcesShared 93`, 2026-09-03 05:01:38 |

**Total:** 2 confirmed occurrences across 2 distinct monitored PRs.

First observed: `2026-09-02T02:59:08Z`. Latest observed: `2026-09-03T05:01:38Z`.

## Classification and impact

**CI infrastructure failure.** The same Azure secure-file service error occurred on unrelated PRs, heads, jobs, and workers. The affected job cannot reach checkout, setup, build, or tests, so this is not evidence of a source or deterministic test regression.

## Investigation performed

- Inspected authenticated Azure build timelines, task issue data, task logs, workers, attempts, and retained retry history for both occurrences.
- Verified the exact HTTP 500, `TF15004`, `DownloadTicketValidationException`, secure-file name, and expired-request-signature text.
- Searched all open and closed `dotnet/macios` issues separately by the exact code and message, secure-file name, and `DownloadSecureFile` component.
- #26457 concerns a Ventura `Show Bot Info` hang, #26382 concerns expired/missing signing credentials, and #19623 is an unrelated Xcode support discussion; none represents this download-ticket failure.

Azure logs and secure-file request metadata are retention-limited.

## Retry status and workaround

- #26523: a failed-jobs retry created simulator attempt 2; `monotouch_maccatalyst` passed on `AcesShared 1` and this signature did not recur.
- #26475: the parent simulator build remains active, so retry is deferred until it is terminal and all other failures can be reconciled.

A failed-jobs retry can clear an isolated occurrence after the PR head, mergeability, active attempts, and retry budgets are refreshed. The infrastructure fix is to ensure the signed secure-file download ticket remains valid until the queued pre-job executes.

Start with the Azure DevOps DownloadSecureFile@1 pre-job and the authenticated build timeline and task logs linked in the issue. Trace how the secure-file download ticket is created and queued, then verify that its signature remains valid until the pre-job executes and that the TF15004 failure no longer occurs across the affected jobs.

Written by the indexing model from the issue text.