Let authenticated API readers see repositories they can read #4

Outcome

Authenticated API readers can read every repository their membership permits while anonymous reads remain limited to public repositories.

Current behavior

Production now uses the optional bearer pipeline for issue-family reads and repository visibility.

Contract

Apply the same repository read predicate to issues, comments, labels, assignees, and milestones.

Acceptance criteria

• Authorized private-repository reads succeed.
• Unauthorized and anonymous private-repository reads return not found.
• Anonymous public reads remain unchanged.

Verification

Qualified in bf68015dd0bfa3689e7e1b5223e3699e0d4e12ef: 2,032 application tests, 14 cluster tests, 17 frontend tests, exact-SHA staging smoke, and production rollout to digest sha256:eac4c42d067e295901eb60c389f06c978628e03f583b0d2ea9edf334d8f745ed.

Dependencies

None.