Match search and listings against the copy on show

### Task Summary

Part of #7828. Search and the listings it feeds read the author's live columns. For a pinned
workflow that is the one copy the public cannot open: a draft would turn up in a public search
under a title nobody has seen, and the card would advertise a name the detail page does not
show.

- **`onVisibleCopy`** builds each filter twice — over the live columns for rows the caller was
granted access to, over the frozen ones for rows they reach only because the workflow is
public — and ORs the two. A disjunction over bare columns rather than a `CASE`, so each side
stays eligible for its own fulltext index. Unpinned public rows fall back to the live columns,
so a following workflow searches exactly as it does today.
- **Both halves of what public search indexes** are covered: the words in a workflow and the
operators in it.
- **Two more things listings carry**, from the same query and with no second round trip: the
frozen name and description to show a viewer without granted access, and whether the copy on
show is behind the author's working copy — which is what a hub card needs in order to open the
copy it is advertising.
- **The hub's own listing query** gets the same treatment. The hub is the public shelf, so
everything on it is listed as the public sees it — the author included, who is looking at the
shelf and not at their own dashboard.
- `constructWhereClause` takes `includePublic` for this; the dataset and project builders accept
and ignore it.

Covered by `WorkflowPublishSpec`, `WorkflowSearchQueryBuilderSpec` and
`UnifiedResourceSchemaSpec`: a draft unfindable by a keyword or an operator that exists only in
it while the author still finds their own; a pinned workflow matching its frozen title and not
its live one; frozen values shown to a stranger and live ones to the author and to a
collaborator; drift reported only for a workflow that has a frozen copy; and an unknown access
answer counted as public, since the reverse is the leak.

### Task Type

- [ ] Refactor / Cleanup
- [ ] DevOps / Deployment / CI
- [ ] Testing / QA
- [ ] Documentation
- [ ] Performance
- [x] Other