Get one federation identity evidence row for owner review

Returns one review-safe evidence projection. Expired pending evidence remains inspectable but is marked non-actionable and has no accept path. This read never accepts or pins a key, issues a challenge, promotes trust, contacts a remote, executes a provider, or spends funds.