Get an app's agent description without changing the app

Side-effect-free sibling of the page gate: no auto-claim, no token mint, no cookie, no mutating telemetry. A public App or listed Template returns the full descriptor to anyone, with operations[].input/output/examples gated on app:read (owner, accepted share grant, team membership, or a bearer token) — an anonymous caller sees discovery-level operation fields only. An enabled-unlisted Template remains private without app:read, as does any other private App. Those callers — including an unclaimed app's claim-cookie holder, which grants app:run but never app:read — get the minimal stub (AppDescriptorStub). Reachable via both the /app/{id} UUID form and the /{handle}/{app-name} friendly form (byte-identical id + canonical_url), and advertised from the served page's <link rel="alternate" type="application/json"> and matching Link: HTTP header.