Read one stored object's exact bytes through the gateway

The gateway-mediated sibling of POST .../object-reads: instead of a presigned URL, the gateway fetches the object server-side and streams the literal stored bytes back, X-Run402-Stored-Bytes-Sha256 carrying their digest — immutable, safe to cache privately forever. Exists because the vault object-storage bucket is deliberately unreachable by anything except the gateway task role (the same confidentiality fence object-reads's presigned URLs already depend on) and carries no browser CORS configuration, so a browser cannot fetch a presigned URL directly; this route is the browser-safe path (the SDK/CLI keep using presigned URLs — a non-browser fetch is not subject to CORS). Body is ONE object descriptor, the same shape as one entry of object-reads's objects[] array. key_envelope reads are RECIPIENT-ONLY, identical rule and identical no-oracle refusal as object-reads. An object that is absent, of a different kind, or already tombstoned (DELETING / DELETED / PRUNE_AUTHORIZED_PRESENT) is 404 RESOURCE_NOT_FOUND. Never lifecycle-gated.