feat(charon): add GET /chain/{id} and split entry call by store flag

[elevran]

Adds a read-only chain-fetch endpoint so the proxy can rehydrate context for store:false turns without committing the current turn's request blob. Prior behaviour called POST /staging on every turn and only skipped the response-side store, which left a request-blob staging record behind when the response was discarded.

What changes

• Server — new HandleGetChain for GET /chain/{id} returning {turns:[…]} root-first; no staging record opened.
• Client — new GetChain(ctx,id,tenantKey) method + Backend interface extension.
• Proxy — new Handler.hydrateContext helper that picks the entry call based on ShouldStore():
  • store:true → POST /staging[?prev=…] (commits request blob, returns staging_id)
  • store:false → GET /chain/{prevID}, or no Charon call at all on the first turn

All three proxy paths (HandleCreate, handleStream, wsTurn) funnel through the helper so the entry decision lives in one place. The atomic POST /responses endpoint is unchanged and remains available for clients that prefer one-shot single-turn writes.

Wire surface after change

store	stream	Entry	Persistence
false	either	GET /chain/{prev} (or none)	none
true	false	POST /staging	PUT /chunks/0 + PUT /complete
true	true	POST /staging	PUT /chunks/{k} flushes + PUT /complete

Tests

• pkg/charon: TestClientGetChain{NotFound,IsReadOnly}
• internal/server: TestGetChain{UnknownID,DoesNotCommit}
• cmd/proxy: handler_test additions for store:false continuation, plus a new backend_routing_test.go that wraps the Charon mux in a recording middleware and pins, for every (stream × store × first-turn|continuation) combination, exactly which Charon endpoint the proxy hit. These pin the wire pattern, not just the response shape.

make presubmit is green.

[elevran]

Clean, well-motivated change. The hydrateContext helper that all three proxy paths funnel through is the right shape, and the routing tests that pin the wire pattern are a good addition. A few minor issues below.