CAN-209, additive read API. Uses the canonical catalog ID, explicit platform and tenant
from the authenticated credential. EMAIL requires a pinned version; WAB-OMNICHAT
forbids version because its catalog is not versioned. Unknown query fields return 400.
Existing records may return 200 with availability.sendable=false. Availability does
not authorize integration, user or recipient; quotas and suppression still apply.

Email content parameters are pinned; category, language, title, integration and status
come from the current root. Never cache the descriptor. This operation does not send
messages, migrate chat-jobs or remove Parse synchronization. Historical Parse IDs,
internalType and catalogs exclusive to other WhatsApp providers are not covered.

Workers use x-app-token on the PRIVATE host (verified inside the Lambda). Public hosts
require x-api-key + x-api-secret and role admin or marketing; app-token alone cannot
pass their API Gateway authorizer. Session credentials take precedence when both exist.