Get Capture Install Receipt

Bounded, owner-scoped answer to "did this installation attempt arrive".

TOS-4487. This is what makes the historical-session false positive impossible: the only acceptable proof of a fresh install is a receipt matching THIS attempt id and THIS source, inside a server-clock age window - never "any existing session for this source".

machine_id is an OPTIONAL narrowing filter, not a required one, and is returned as evidence instead. The browser cannot know it: the CLI mints it locally per account binding and never tells the UI. The attempt id is the correlation key the caller actually owns - 128 random bits it generated for this one attempt - so requiring machine_id as an input would only have made the endpoint uncallable from the surface it exists to serve.

Ownership is enforced by filtering on (identity_id, attempt_id) first, exactly like get_external_session: a foreign or never-arrived attempt_id can never match another caller's own identity_id, so this returns 404 with no existence disclosure whether the attempt belongs to someone else or never happened at all. A match that DOES exist for this caller but under a different source/machine_id, or outside max_age_seconds, is deliberately NOT a 404 - it is a 200 with every fact false, because the attempt genuinely is this caller's own and simply has not (or no longer) produced matching evidence.

Never pages through capture history: the lookup is one indexed equality scan on (identity_id, attempt_id) - the leading columns of CaptureInstallReceipt's unique constraint, so no extra index is needed - bounded by a small LIMIT, and every install attempt has at most one row per distinct trigger by construction.