Get the current mablnet peer-CA trust bundle for a link infrastructure cluster

Returns the publisher-signed envelope carrying the X.509 root certificate(s) every mablnet client trusts as peer-CA roots when verifying mabl-side Host certs during the peer-to-peer QUIC TLS handshake. One bundle per link infrastructure cluster: the shared cluster's unless infrastructure_key names a dedicated one, and the same bundle for every caller asking for that cluster. A dedicated cluster's envelope carries its key in a signed cluster field, which a caller must check against the key it asked for; the shared cluster's has none. Bundle bytes come from the cluster's published trust bundle — the same anchors its Link Routers load on startup. More than one anchor may be present: a root rotation publishes the incoming anchor alongside the outgoing one, and callers should trust every certificate in the envelope. The anchors are non-secret — X.509 root certificates are public artefacts by definition; protection here is integrity, not confidentiality. Auth is required for attribution / rate-limiting / audit, not because the bytes are sensitive. Integrity is what the envelope provides, and it is the only thing that makes these anchors safe to fetch: a caller must verify the signature against a publisher key it already holds, and must not accept anchors from anywhere else in this response. Conditional refetch: callers send their last-known ETag as If-None-Match on each poll. The server returns 304 Not Modified (no body) when the bundle is unchanged. The current ETag is mirrored in both the standard ETag header and the mabl-specific x-mabl-entity-version header (the latter survives upstream gzip-Vary stripping).