fix(broker/cli): e2e get_file owner sealedKey bug

broker: owner also fetches sealedKey from mesh.file_key (not skipped),
  only non-owners are blocked when key is missing
cli: explicit error when encrypted file has no sealedKey (no silent raw download)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/cli/src/mcp/server.ts

@@ -527,7 +527,8 @@ Your message mode is "${messageMode}".
         const result = await client.getFile(id);
         if (!result) return text(`get_file: file ${id} not found`, true);
 
-        if (result.encrypted && result.sealedKey) {
+        if (result.encrypted) {
+          if (!result.sealedKey) return text("get_file: encrypted file — no decryption key available for your session", true);
           const { openSealedKey, decryptFile } = await import("../crypto/file-crypto");
           const { ensureSodium } = await import("../crypto/keypair");
           const myPubkey = client.getSessionPubkey();