Close the visa-data leak at its factory + harden the gate

The field-access-visas table (580 KB -- how workers enter closed
countries) was found PUBLIC in three copies and LIVE-SERVED at 200:
the key-cities bundle data dir, the research out/ dir, and a stale
staging tree inside the served catalog. Root cause: emit() enforced
PRIVATE_TABLES but the ROUTE bundle-copy loop did not -- a privacy
rule enforced at one of two writers is not a rule. The loop now skips
PRIVATE_TABLES; the redundant source copies are deleted (data-private/
keeps the one canonical file); and the hygiene gate flags the
filename and visa_ fields as HARD findings in every mode -- this data
class never rides the strict-tier softening.

All three public copies and the live URL were purged first and
verified 404 by anonymous fetch before this commit.

internal/public-hygiene-check.mjs

@@ -62,6 +62,11 @@ const LEAK = [
   [/\/home\/[a-z0-9_-]+\//i, 'local path (/home/…)'], [/\/Users\/[A-Za-z0-9_-]+\//, 'local path (/Users/…)'], [/[A-Z]:\\Users\\/, 'local path (C:\\Users\\…)'],
   [/\beco-dx\b/, 'internal folder name (eco-dx)'], [/qa-cycle/, 'internal folder name (qa-cycle)'], [/\b_archive\b/, 'internal folder name (_archive)'],
   [/localhost:(5174|3001|3033)\b/, 'dev-server URL'],
+  // ★ HARD in every mode (Driver-critical, 2026-09-24): field-access / visa data must never
+  // ship in ANY public tree -- it maps how workers enter closed countries. Found live-served
+  // before this rule existed. Filename AND content patterns, no strict-tier softening.
+  [/field-access-visas/, 'PRIVATE data-class: field-access/visa table (see data-private/README.md)'],
+  [/"visa_/, 'PRIVATE data-class: visa field in shipped data'],
 ]
 // ★ ADDED 2026-09-24 (public-exposure audit, policies P3/P4/P7). A public tree carries
 // ARTIFACTS, never PROCESS or operational context — each of these was found live in a public

library/scripts/research/build-tabulator-tables.mjs

@@ -1318,6 +1318,13 @@ const ROUTE = {
 for (const b of built) {
   const app = ROUTE[b.name];
   if (!app) continue;
+  // ★ THE LEAK THIS LOOP CAUSED (found live 2026-09-24, Driver-critical): emit() already
+  // respects PRIVATE_TABLES and writes those to data-private/ -- but THIS loop copied from
+  // out/tables into the BUNDLE's data dir without the same check, so field-access-visas.json
+  // landed in plugin-designs/key-cities/data/tables/, flowed into the public snapshot AND the
+  // served catalog, and was fetchable by anonymous clone + live 200. A privacy rule enforced
+  // at ONE of two writers is not a rule. Same check, both writers:
+  if (PRIVATE_TABLES.has(b.name)) continue;
   const dir = join(PROFILES, app, 'data', 'tables');
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(join(dir, `${b.name}.json`), readFileSync(join(TABLES, `${b.name}.json`)));