Vault Feed Pull

Per-product data distribution — the "funnel out" half of the chain. A product authenticates as ITSELF (HMAC-signed, empty-body GET) and pulls the vault events it consumes: its OWN source_system events (leads it was routed + lifecycle it emitted) PLUS the cross-product data streams its surface subscribes to (energy / grid / solar / marine / market / geophysical / ...). Routing comes from atlas_surfaces.feed_selectors (one source of truth with the dashboards). Cursor on created_at (ascending); the client dedupes on event_id, so created_at>=since never skips a same-timestamp row.