Get a guest-published agent's cover image

Returns the raw cover image bytes for a guest-published agent. The Content-Type is inferred from the file extension (.png → image/png, .webp → image/webp, otherwise image/jpeg). Cached for 5 minutes (Cache-Control: public, max-age=300). Returns 404 when the agent is not found, not guest-published, has no cover image, or the cover file is missing from S3. No authentication is required.