Fetch a signed CyclesEvidence envelope by content id

Retrieve the signed CyclesEvidence envelope identified by evidence_id (the sha256 content hash carried on a receipt's cycles_evidence reference). Returns the envelope exactly as emitted — JCS-canonicalizable and Ed25519-signed per cycles-evidence-v0.2 — so any holder can verify it offline without trusting this server. AUTH (NORMATIVE): this endpoint is PUBLIC (no ApiKeyAuth). The evidence_id is an unguessable sha256 content hash that acts as a capability — only a party already holding the receipt (which carries the id) can fetch the envelope. Because the envelope is content-addressed and signature-verifiable, public read cannot forge or alter it. Servers SHOULD rate-limit this endpoint and SHOULD serve it with Cache-Control: public, immutable (the content never changes).