refactor(db): share update path so set_visibility avoids a redundant fetch; tie public-visibility const to the enum; test internal exclusion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/db/tests/visibility.rs

@@ -140,6 +140,13 @@ async fn public_reads_return_only_public_records(pool: PgPool) {
     )
     .await
     .unwrap();
+    let internal = catalog::create_object(
+        &mut tx,
+        AuditActor::System,
+        &object("I-1", Visibility::Internal),
+    )
+    .await
+    .unwrap();
     tx.commit().await.unwrap();
 
     assert!(
@@ -168,4 +175,12 @@ async fn public_reads_return_only_public_records(pool: PgPool) {
             .unwrap()
             .is_empty()
     );
+
+    // internal records are excluded from public reads too (not just draft)
+    assert!(
+        catalog::public_object_by_id(db.pool(), internal)
+            .await
+            .unwrap()
+            .is_none()
+    );
 }