Download the OpenSSH public key file of a key pair

Streams the OpenSSH public key blob of the selected key pair as a plain-text file, backing the primary "Download public key" action on the key pair detail page (the UI saves it as <key-pair-name>.pub, terminated with a trailing newline). The content is the exact usedBy-independent public key line — algorithm prefix, base64 key material and comment — ready to append to ~/.ssh/authorized_keys on any host or to attach when launching an instance. Only public material is ever served here; the private key is not stored by the platform and is never available from any read endpoint. Validation: scopeId must be accessible to the caller (404 via ErrNotFound when unknown); keyPairId must identify a key pair within that scope (404 NOT_FOUND). No body or query inputs beyond the path. Async & state: Synchronous read; no state change. The file is served with Content-Disposition: attachment; filename="<name>.pub". Errors: 401 unauthenticated; 403 caller lacks a read-capable role (owner|admin|contributor|reader) on the scope; 404 unknown scopeId or keyPairId; 500 on retrieval failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The public key is immutable for the life of the key pair, so responses are strongly cacheable by ETag.