Fail closed on absent content visibility in 0.3.2

[Jess Sullivan (Jesssullivan)]

Summary

• release source as 0.3.2 against immutable content-types 0.3.1
• fail closed to private for missing, null, and empty visibility throughout list/detail/profile/scheduling paths
• make event detail federation visibility inherit the normalized private default
• keep unrelated overlay fixtures explicitly public instead of depending on an implicit default

Boundary

This is the downstream adoption of content-types 0.3.1. It changes the prior content 0.3.1 behavior where missing visibility was treated as public. Explicit legacy published visibility still maps to public; a separate published: true status does not grant public visibility.

Verification

• focused Vitest against the exact v0.3.1 content-types source: 4 files, 53/53 tests passed
• git diff --check
• signed commit c84ec2e34deaa60ce2bc783e31296bc0d395dc1d

A local full Bazel attempt resolved the new registry coordinate and reached analysis, but the isolated output root exhausted the workstation volume while fetching transitive first-party package graphs before tests ran. The repo-owned remote //:pkg //:test lane is the merge authority.

Linear: TIN-2656