D4: reconcile historical selected=false still-published personal rows (#178)

[xenodeve]

Parent

Part of #178

What to build

Optional one-shot reconcile: unpublish personal github projects rows whose matching member_projects.selected is false (historical drift before sync shipped). Dry-run by default; apply gated. Secret-guarded or admin-only.

Acceptance criteria

• Dry-run lists would-unpublish ids without writing
• Apply unpublishes only personal matches with selected=false
• Team rows never touched
• Tests for plan/filter behavior

Blocked by

• D1 planner (preferred after D2)

[xenodeve]

EN

Blocked by: #179 (prefer after #180)

TH

บล็อกโดย #179

[xenodeve]

EN

planHistoricalShowcaseUnpublish + admin reconcileDeselectedPersonalShowcase (dry-run default). Ready for optional apply.

TH

D4 planner + server action พร้อม dry-run