Get a signed Safe House decision certificate

The public, offline-verifiable certificate for a signed SafeHouseDecision (MNE-1381 / C14): the exact signed_payload string, the chain hashes and the covered-content hash (proofs.chain.content_hash), so a third party can check sha256((prev_chain_hash ?? "genesis") + "|" + content_hash) === chain_hash and the Ed25519 signature against the public key from GET /v1/keys — without trusting this API. The reconstructed canonical decision (screen result, tool, resource selectors, provenance detail) and the run/card identifiers are returned only to a caller who can see the agent's private telemetry (a member of the org that governs the agent, the same gate as the checkpoint certificate); anyone else gets decision: null, those subject fields as empty strings, and a redacted list naming what was withheld. 404 when the decision is not signed. Public endpoint, no authentication required.