Social-media crawlers (Facebook, Twitter/X, Slack, Discord) never have a Clerk session, so the new OG image route was 307-redirecting every one of them to /sign-in instead of serving the image — found while live-testing right after deploy, same class of bug as the GDPR-export route fix.