Get this layer's protection manifest

Returns the org-scope protection spec as authored. Response is content-negotiated — YAML by default, or JSON with Accept: application/json. Pass ?include_composition=true to include the _composition metadata block describing which scopes were merged. Pass ?include=sources (see ADR-053) for the scope-resolution envelope — the contributing layers plus the composed result; the envelope shape is scope-specific. ETag is computed from content_hash (cards-as-primitive Phase 1); If-None-Match returns 304. For the composed view across scopes, use the /effective sub-resource (Wave 2). Authorization: the caller must be a member (any role) of the organization named by org_id; a non-member (or an org id that does not exist) receives 403, so the response never reveals whether another tenant's org exists and never returns its data.