Get Issuer

GB3: the runtime issuer key (roadmap §9.2). Public — an exact entry in the auth skip list — so a verifier can fetch it with no access, like /v1/cgr/issuer. A CONVENIENCE: per GD2 the key and its fingerprint are delivered in the onboarding pack and confirmed out of band, and a verifier must never trust this value on first fetch nor re-fetch it to check a record (decision 0011 §8.2). No separate sha256 fingerprint (operator decision): key_id_grouped is the read-aloud form of the key id. key_history is null until a key history exists (roadmap §9.4).