Internal Publisher Config

Server-only publisher guards the client can neither see nor change: a hard filter guard, an output-field allowlist, and a sort allowlist. Applied to this cluster's Elasticsearch queries.