Stream a fragment’s evidence bytes (parent asset, v1)

Fragment twin of the asset stream: v1 serves the WHOLE parent asset’s bytes (no locator cropping yet) under the STRICTEST union of the fragment’s and the asset’s piiClasses. Streams the asset’s original bytes after the full gate ladder: brain:read scope, ABAC action rest.evidence.raw, tenant fence (availability='hot', quarantine clean-or-absent), at least one live ownership grant (a user-bound key needs the end user’s own), current pack modality consent declaring the raw-evidence capability, and the media-PII polarity (unclassified blocked, [] open, non-empty needs brain:read_media). Any denial is a bare 404. 404 until EVIDENCE_RAW_READ_ENABLED=1. Source: src/evidence/evidence-read.controller.ts.

Required scope: brain:read.