Inherit generated result disclosure without failing mixed public/secret capability catalogues #197

A mixed generated schema containing public inventory entities and an operator settings entity with classification = "secret" currently fails complete AI query capability compilation with query entity has no exportable selections. This was reproduced downstream against published workspace-2026.10.20.4 (ORM0.55.1); source review also confirms the gap in latest published workspace-2026.10.22.1 (ORM0.57.0).

Entity fields correctly inherit Secret/NeverExport. Generated operation result metadata leaves result_disclosure=None, however, so provider admission attempts to compile the secret result and aborts unrelated public capabilities. A public relationship pointing at an entirely private result has the same issue during nested selection construction.

Required upstream behavior: preserve the full finished operator SDL, generated query and Changed roots, and canonical semantic catalogue. Inherit generated root classification/structural export facts, including collection wrappers; exclude nonexportable root results from provider capabilities. Public plans must not offer secret/entirely nonexportable relation projections. Keep explicit stricter disclosure and reject stale descriptor fingerprints. Do not require downstream catalogue filtering or a weaker export policy.

Regressions should compose a real schema_roots-generated mixed schema, cover list/keyset/scan wrappers and static/runtime descriptor construction, retain all public capabilities and operator roots, reject private provider plans, and validate fingerprint behavior. This is also relevant to the public/private AI projection boundary in #184/#189.

Upstream native reproduction/qualification is pending exact grants; no upstream executable result is claimed from source review.