Read exact immutable policy routing projection

After-commit/replay routing-cache proof. Requires original immutable operation actor, write scope and its current exact full/selected-alias management ceiling. Dedicated session callback accepts only this GET/UUID path with source_epoch and purpose=consumer_artifact_policy_projection, runtime sessionToken cookie header and exact purpose header; it reauthenticates the actual Better Auth session. Bearer presence never falls back to cookies. Current returns the caller-authorized scoped receipt. For alias recovery, the internal proof may select full current projection (selected_alias_id:null) only after the same principal passes and rechecks the existing full management ceiling; otherwise it stays selected-only. The external policy POST response remains narrow. superseded returns receipt:null with no obsolete raw tokens. No independent user action, content grant or global identity endpoint.