Read the declarative client-state document for the caller

Returns the state the caller's client should converge on. Scope is resolved from the actor alone — a caller can only ever read their own state, never another org's. The document is a signal, not a command: it reports whether managed requirements exist, while the vetted list stays behind POST /v1/policy/evaluate. Supports conditional GET via ETag and If-None-Match: a matching token returns 304 with no body.