Stream a tar of one checkpoint's code.

snapshot_id names a Postgres snapshot of this channel, and the route streams the sha that row recorded. Without it the route streams the channel's current_sha, which is what an export holds today. The parameter is deliberately not an arbitrary ref: this route serves checkpoints, and GET /apps/{app_id}/tree already serves an arbitrary ref.

The channel load runs FIRST, so a stranger reads 404. The flag follows it. A row with no recorded sha answers 404 snapshot_sha_unknown, and so does a channel that never deployed. A sha the cell cannot resolve answers 404 snapshot_code_gone: the cell's pin ref protects the current sha alone, so a force-push plus a later git gc can remove an old checkpoint's commit. Both 404s are permanent, and a client must not repeat the call.