Get a mablnet publisher keystore document

Returns the signed keystore document (publisher public keys) a supervisor uses to verify manifest signatures. Defaults to the latest keystore; pass keystore_version to fetch a specific one — a supervisor does this when a manifest's requiredKeystoreVersion exceeds its local keystore version. Like the manifest, the body is an opaque Ed25519-signed document returned with field values preserved. Conditional refetch via If-None-Match / ETag, identical to the manifest endpoint.