Delivery: a public lookup by reference plus an identifier, returning named fields only and throttled

Found by simulating a Claude Code build of Color Me Fun 2026 through the barako CLI (epic #801) on 14 September 2026; the event registration app for the Rotary Club of Koronadal is the acceptance test. Simulation page: https://claude.ai/code/artifact/05afda1a-6461-431d-aff0-50b30d3b0778

Runners check their registration without an account: reference plus last name or email, and nothing personal comes back (Color Me Fun CONTRACTS.md rule 4). Saved queries only run behind `manage_queries`, and public delivery is for published content, so there is no way to answer this without a module.

## Change

A public lookup defined as configuration on a content type:

- **Match** on one field (the reference) and **verify** with one of several others (last name or email), compared case-insensitively. Neither alone returns anything.
- **Return** only named fields, never sensitive or hidden ones, whatever the definition says.
- **Reveal** extra fields only while a singleton setting is on (the claim stub token once `KitReleaseOpen` is true).
- **Throttle** attempts per IP and per reference, and answer a miss and a failed verification the same way, so the lookup cannot confirm that a reference exists.

## Done when

- The right reference and last name return status and bib number; a right reference with a wrong name returns the same response as an unknown reference.
- A field marked Sensitive or Hidden cannot be added to the returned set.
- Repeated misses from one address are throttled.

Read CONTRACTS.md rule 4 and the public delivery path first, then inspect how manage_queries and the KitReleaseOpen singleton setting are represented. Use the Color Me Fun registration app as the acceptance scenario; done means safe named-field responses, indistinguishable misses, and throttling for repeated IP attempts.

Written by the indexing model from the issue text.