Immutable compiled content of one version — the read path of the send flow.

A published version never changes, so the consumer can cache by
retailerId + templateId + version with no invalidation. The {{n}} come back intact; the
adapter replaces position by value.

Authentication depends on the host. On the public host the credential is the panel
session (x-api-key + x-api-secret): its authorizer declares
identitySource: x-api-key, x-api-secret, so a request without those headers is refused
with 401 by the API Gateway before the Lambda runs — an x-app-token sent there is
never read. The service alternative lives on the private host
(PrivateFindEmailTemplateVersion, no API Gateway authorizer), where x-app-token
signed with AUTH_LAYER_APP_TOKEN_JWT_SECRET (the same mechanism as the
waba-api-manager) authenticates the caller. The send worker has no user and no role, so
requiring admin|marketing would make the route unconsumable. Either way the tenant comes
from the credential, never from the path.