Stream a stored render artifact (native app).

Native app only (DVT-1364, exportDelivery: render_app_stage): streams a succeeded render's PNG/PDF from the app-owned stage @app_spcs.renders, app-authenticated — the replacement for a signed URL. Served only to the render's requester (anyone else gets 404); Cache-Control: private, no-store, X-Content-Type-Options: nosniff, Cross-Origin-Resource-Policy: same-origin; PNG inline, PDF as an attachment. 404 artifact no longer available when the stored object is gone (e.g. after an app reinstall recreated the stage). Always 404 where renders are stored in R2.