Enforce field permissions in the query, search, and update specs

Team-distributed sweep, after the enforcement foundation lands: apply the carried field set in every entity's specs - blank unpermitted fields on reads, drop them from update input, refuse filtering and sorting by them, and reject explicitly requested unpermitted GraphQL fields at the layer the enforcement BEP fixed. Compose field coverage on top of the BA-7593 primitives (bits covering all fields vs bits per named field - never OR across different fields; the entity-level gate never changes). Merge actions that differ only by fields into one operation, based on the sweep issue's list. Split per entity family for parallel assignment.

JIRA Issue: BA-7562

Start with the BA-7593 enforcement primitives and the sweep issue's entity-family list, then inspect each entity's query, search, update, and GraphQL specs. Done means unpermitted fields are blanked, excluded from updates, rejected in filtering and sorting, and explicitly requested GraphQL fields are rejected without changing the entity-level gate.

Written by the indexing model from the issue text.