/api/v1/environments/{id}/files/{path}

Raw bytes response (application/octet-stream) with the content digest in

X-Eaas-File-Sha256; error paths still use the standard failure envelope. {path} is

the normalized workspace-relative path (the route is a catch-all, so it may contain

/ segments; .. traversal and absolute paths are rejected). Reads are capped at

1MB via maxBytes; a missing file is 404 not_owned. Principal sessions may read

files of their bound environment.