Separate trusted hidden propagation witnesses from public field exposure #218

Upward Changed propagation currently authorizes each source foreign-key field through subscription_field_policy and requires its public subscribable flag. A private linkage field marked read=false/subscribe=false therefore suppresses a generated parent event, even when the host can authorize using that field internally. Flipping those public flags would expose private identity/binding metadata and is not acceptable. The tuple-aware path from #194 retains the same check.

Provide an explicit trusted provenance-field policy contract distinct from public scalar/filter/subscription exposure. A generated internal witness may use a hidden complete relation binding only under current host source/target/link authorization and trusted after-commit provenance. It must not automatically release the hidden value, source identity or path metadata: those outputs need independent authorization/redaction. Keep the public field absent from SDL/input/filter/order and direct selected subscription payloads; no raw observer event or local custom emitter bypass.

Acceptance: a source record with hidden canonical parent key generates an authorized parent invalidation while the hidden key remains unselectable/unfilterable/unsubscribable. Denied source/target/link/provenance policies suppress the entire event; revocation after queueing does likewise. Test complete composite keys, hidden source metadata, collisions and rollback using owned synthetic fixtures. This does not weaken the existing default-deny behavior or authorize external source writes/schema operations.