Get the current mablnet peer-CA trust bundle for this environment

Returns the X.509 root certificate(s) every mablnet client should trust as peer-CA roots when verifying mabl-side Host certs during the peer-to-peer QUIC TLS handshake. Per-environment global: the same bundle for every caller in a deployment. Bundle bytes come from the deployment's published trust bundle — the same anchors Link Router loads on startup. More than one anchor may be present: a root rotation publishes the incoming anchor alongside the outgoing one, and callers should trust every certificate in the bundle. The bundle is non-secret — X.509 root certificates are public artefacts by definition; protection here is integrity, not confidentiality. Auth is required for attribution / rate-limiting / audit, not because the bytes are sensitive. Conditional refetch: callers send their last-known ETag as If-None-Match on each poll. The server returns 304 Not Modified (no body) when the bundle is unchanged. The current ETag is mirrored in both the standard ETag header and the mabl-specific x-mabl-entity-version header (the latter survives upstream gzip-Vary stripping).