Get run details including step runs.

auth is declared to enforce authentication via FastAPI's dependency system; the project-perm check is resolved against the run's own company so multi-company users polling a run (e.g. dashboard InputForm) are not 404'd when their selected X-Company-ID differs from run.company_id.

That cross-company read is a real feature, but it used to be authorized by the REQUEST's checker, which short-circuits on scope.role == "owner". An owner of company A holding a run UUID from company B therefore passed — _require_project_perm scopes its Project load to the company it is handed (B's), so nothing else looked at the caller's tenant. Membership in run.company_id is now verified explicitly and the grant is evaluated by a checker scoped to THAT company, the same shape dashboard_data._dashboard_scoped_perms uses. permissions is still declared so the request-scoped dependency (and its auth) is constructed.