GET /v1/care-bundles/runs/{run}
GET /api/v1/care-bundles/runs/:run_id
Strips fail_message for callers without care-bundles.materialize
(same policy as the runs listing above) so a viewer who guesses a
run id can't read schema names or query text from a failed run.
Request