AGPL: Should sites provide public download links for CiviCRM extensions?
I'm certainly not a lawyer, but I've always assumed the answer to all three questions is "Yes".

That said, I haven't made a comprehensive effort to do so - though my current policy is to post all extensions on Github (and I only use overrides within an extension framework).  I wouldn't want to make my clients post a link, but in theory my Github page would be a single point of download.

To date I don't believe the AGPL has been tested in court though - so I'd expect lawyers to make the argument, perhaps successfully, that the AGPL isn't (always) binding.  Given that many nations' jurisdictions have upheld similar arguments against the GPL, that argument would have an uphill climb.

My take is that the main beneficiaries of the AGPL are the organizations who use CiviCRM vis-a-vis developers they hire.  It's a very powerful tool against vendor lock-in!