feat(workflow): match search and listings against the copy on show

[yangzhang75]

What changes were proposed in this PR?

A listing is where most people meet a workflow, so it has to agree with what opening it shows.
This makes search and the hub match, display and link against the copy on show.

• Search matches the copy the caller may see. One search returns both the caller's own
  workflows and public ones, so the filter is a disjunction of guarded filters — the working copy
  for rows they were granted, the frozen copy for rows they reach only because those are public.
  Written over bare columns rather than a CASE, so each side stays eligible for its own PGroonga
  index. A pinned workflow no longer turns up on keywords that exist only behind the pin, and the
  author still finds their own work on what they just typed.
• Listings show the frozen name and description to a viewer without granted access — the same
  copy the detail page serves, so a card cannot advertise a title that opening it does not show.
  Both are NULL while following, which leaves the live values in place.
• The hub is the public shelf, so everything on it is listed as the public sees it, for the
  author too: they are looking at the shelf, not at their own dashboard.
• One definition of "the public is behind". WorkflowPublishService.pinDiffersFromWorkingCopy
  is the share dialog's comparison as a SQL condition, and the search projection and the hub
  listing both use it, so a card and the dialog cannot disagree about whether edits are held back.

Any related issues, documentation, discussions?

Closes #7940
Part of #7828. Design discussion: #7128. Stacked on #7853 and #8575; until those merge this PR
shows their commits too, and the review here is the last one.

How was this PR tested?

19 new cases in WorkflowPublishSpec plus WorkflowSearchQueryBuilderSpec and
UnifiedResourceSchemaSpec (567 in the dashboard package):

• search not matching a public workflow on anything that exists only in unpublished edits, and
  matching it on its published copy — content, name and description, each separately;
• an unpinned public workflow still matching the author's latest, and the author still matching
  their own workflow on a name only they can see;
• a listing showing a public viewer the published name and description, a collaborator the live
  ones, and a private workflow's own listing untouched;
• the drift flag a card carries: true while a pin holds edits back, false for a workflow with
  nothing frozen, and equal to what the share dialog reports for the same workflow — including
  after a rename and after a change of view, the two fields most easily left out of one of the
  three places that answer this.

The shared condition was checked by mutation: dropping the default-view term from it turns the
card-versus-dialog case red.

scalafmtCheckAll clean.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 5)

🤖 Generated with Claude Code

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @aglinxinyuan, @tanishqgandhi1908
  You can notify them by mentioning @aglinxinyuan, @tanishqgandhi1908 in a comment.

[github-actions]

⚠️ Benchmark changes need a look

🟢 2 better · 🔴 7 worse · ⚪ 6 noise (<±5%) · 0 without baseline

Compared against main b43d465 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	446	0.272	21,943/25,742/25,742 us	🟢 -23.0% / 🔴 +99.5%
🔴	bs=100 sw=10 sl=64	930	0.567	102,679/157,278/157,278 us	🔴 +35.5% / 🔴 +67.7%
🔴	bs=1000 sw=10 sl=64	1,131	0.69	871,903/1,037,687/1,037,687 us	🔴 +13.2% / 🔴 +14.7%

Baseline details

Latest main b43d465 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	446 tuples/sec	444 tuples/sec	963.37 tuples/sec	+0.5%	-53.7%
bs=10 sw=10 sl=64	MB/s	0.272 MB/s	0.271 MB/s	0.588 MB/s	+0.4%	-53.7%
bs=10 sw=10 sl=64	p50	21,943 us	20,661 us	10,998 us	+6.2%	+99.5%
bs=10 sw=10 sl=64	p95	25,742 us	33,434 us	13,515 us	-23.0%	+90.5%
bs=10 sw=10 sl=64	p99	25,742 us	33,434 us	16,850 us	-23.0%	+52.8%
bs=100 sw=10 sl=64	throughput	930 tuples/sec	1,006 tuples/sec	1,235 tuples/sec	-7.6%	-24.7%
bs=100 sw=10 sl=64	MB/s	0.567 MB/s	0.614 MB/s	0.754 MB/s	-7.7%	-24.8%
bs=100 sw=10 sl=64	p50	102,679 us	98,685 us	87,833 us	+4.0%	+16.9%
bs=100 sw=10 sl=64	p95	157,278 us	116,092 us	93,795 us	+35.5%	+67.7%
bs=100 sw=10 sl=64	p99	157,278 us	116,092 us	103,718 us	+35.5%	+51.6%
bs=1000 sw=10 sl=64	throughput	1,131 tuples/sec	1,148 tuples/sec	1,273 tuples/sec	-1.5%	-11.1%
bs=1000 sw=10 sl=64	MB/s	0.69 MB/s	0.701 MB/s	0.777 MB/s	-1.6%	-11.2%
bs=1000 sw=10 sl=64	p50	871,903 us	867,764 us	861,707 us	+0.5%	+1.2%
bs=1000 sw=10 sl=64	p95	1,037,687 us	916,457 us	904,523 us	+13.2%	+14.7%
bs=1000 sw=10 sl=64	p99	1,037,687 us	916,457 us	931,473 us	+13.2%	+11.4%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,448.87,200,128000,446,0.272,21942.79,25741.92,25741.92
1,100,10,64,20,2151.68,2000,1280000,930,0.567,102679.42,157278.45,157278.45
2,1000,10,64,20,17680.17,20000,12800000,1131,0.690,871903.40,1037686.67,1037686.67

[codecov-commenter]

Codecov Report

❌ Patch coverage is 92.79661% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.72%. Comparing base (bcd0ec4) to head (5d4e022).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...shboard/user/workflow/WorkflowPublishService.scala	86.27%	4 Missing and 10 partials ⚠️
...ra/web/resource/dashboard/SearchQueryBuilder.scala	50.00%	1 Missing ⚠️
...esource/dashboard/WorkflowSearchQueryBuilder.scala	97.95%	1 Missing ⚠️
...rce/dashboard/user/workflow/WorkflowResource.scala	98.30%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #8576      +/-   ##
============================================
- Coverage     92.73%   92.72%   -0.01%     
- Complexity     4947     4954       +7     
============================================
  Files          1241     1242       +1     
  Lines         52608    52788     +180     
  Branches       6507     6543      +36     
============================================
+ Hits          48785    48950     +165     
- Misses         2206     2212       +6     
- Partials       1617     1626       +9     

Flag	Coverage Δ		*Carryforward flag
access-control-service	77.38% <ø> (ø)		Carriedforward from e1f144b
agent-service	99.16% <ø> (ø)		Carriedforward from e1f144b
amber	88.51% <92.79%> (+0.03%)	⬆️
computing-unit-managing-service	60.41% <ø> (ø)		Carriedforward from e1f144b
config-service	87.37% <ø> (ø)		Carriedforward from e1f144b
file-service	81.53% <ø> (ø)		Carriedforward from e1f144b
frontend	96.55% <ø> (ø)		Carriedforward from e1f144b
notebook-migration-service	83.73% <ø> (ø)		Carriedforward from e1f144b
pyamber	98.50% <ø> (ø)		Carriedforward from e1f144b
workflow-compiling-service	74.09% <ø> (ø)		Carriedforward from e1f144b

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.