Retrieve a revision bundle GET
The bundle contains pre-rendered Kubernetes manifests (from Helm template,
kustomize build, or raw manifests) ready for server-side apply. The agent
does not need to render anything -- it applies the bundle as-is.
The cluster is identified by the service access token's binding. Returns
PERMISSION_DENIED if the revision's target cluster does not match the
SAT's cluster binding. Returns NOT_FOUND if the revision does not exist
or has been canceled.
Scope: `cluster:deploy` | Token types: `sat`