Update: It turns out the host (privately hosted GitHub) is setting sandbox policy for its CSP which does not explicitly set 'allow-downloads'. As a result of this, we cannot use 'meta' tags in the HTML headers to override it. The only real options are to either workaround (force use to right click and save the Blob URL link) or to change the actual CSP policy on the server side.

Hope this helps someone who runs into this down the line.