Get a presigned download URL for the workflow's latest PSV PDF

Returns a tenant-scoped, server-resolved presigned download URL (valid for 1 hour) for the most recently generated Provider Summary Verification (PSV) PDF for the credentialing workflow identified by id. The storage path is always resolved server-side from the workflow's timeline events and never accepted from the client (no query parameters are supported). Returns 200 with a PsvPdfDownloadResponse when a completed PSV PDF is available. Returns 202 with {workflowId, status: "GENERATING"} when a PSV generation is currently in progress — poll this endpoint again after a delay. Returns 404 when no PSV PDF has ever been generated for this workflow, or when the workflow does not belong to the requesting tenant.