Return public-key + Merkle proof + signed-action count for a cert.
cert_id may be either:
64-char lowercase hex SHA-256 fingerprint, or
RFC-4122 UUID string of the certificate row primary key.
The endpoint is unauthenticated – intended for prospects who
receive a signed decision and want to verify the agent’s public
key independently. Cache-Control is private, no-store so
intermediaries do not fan out per-cert lookups.
Returns 404 when the cert id is unknown; 409 when the cert exists
but has not yet been appended to the Merkle tree (race window
during issuance, fail-closed).