Supporting Run.ARTIFACTS is onerous in plugins.

They need to check first if the permission is enabled and then check the permission.

The permission should just be enabled always, simplifying calling code, and then if the system property is set it should not be implied by any other permission, otherwise it should be implied by access to the containing Job via Item.READ.

(which is technically invalid for permission scope - however there are several abuses of PermissionScope already)