Get Agent Run

Fetch one run.

THE ONE ROUTE HERE THAT IS NOT PURE DELEGATION, because there is no GET /v1/agent/work-items/{id} on the JWT surface to call. Without it a builder can create a run, receive its id, and then have no way to poll it except by listing everything and filtering client-side.

Its visibility rule is copied from list_work_items, NOT from cancel_work_item: a read may see the caller's own runs plus org-wide visibility='shared' ones, whereas cancel is owner-only because stopping someone else's work is destructive. Pinning the read to the stricter rule would hide a shared run that the list route shows, and the two disagreeing about the same row is worse than either answer alone.

404, never 403, on a run the caller may not see: a non-owner must not be able to use this route to probe which runs exist in the org. Same reason cancel_work_item returns 404 for a non-owner.