Get Deployment

Fetch one deployment.

Polling a build is the most common loop in a deploy flow, and without this it required listing every deployment and filtering client-side.

REGISTERED AFTER GET /{app_id}/deployments/active, and the order is load-bearing rather than cosmetic. Both are three segments with a literal or a parameter in the same position, so declaring this first would capture active as a deployment id and that endpoint would 404 for everyone. GET /workflows/dispositions spent months doing exactly that in production.

404 rather than 403 for a deployment belonging to someone else's app, because a 403 confirms the id exists. _own_deployment is the only way this module loads one, so a new route cannot skip the ownership check without also having nothing to work with.