in strategy 3 grasp servers dont expose "/api/nostr/repo/files" or "/api/git/file-content?sourceUrl=". are you saying you have a bridge that servers the files over that API ie go to strategy 5?

strategy 4 - files are never embedded in event content. isn't extracting the clone urls just strategy 3? You should look up the state event `30618` and if there is one trust that rather than the refs provdied by the clone urls. by the looks of it, 99% of files are going to be delivered from your bridge, so i guess that should happen there also.