Get Agent Config History Entry

Return the masked full config for a specific history version.

Stored snapshots are re-validated through CreateAgentConfigRequest on the response path. If the validator has tightened since the snapshot was written, surface the error as 422 so the FE can explain the drift

• same shape the rollback endpoint uses. Unhandled, the error would otherwise land as a 500.