docs(security): add publicSharing.enabled standing-policy paragraph (#14746)

Item 2 of #14582 (follow-up to #14033 / PR #14580, split from #14033's
docs surfaces that PR #14580 could not touch). The "Public Share Links"
section documented the child predicate (eligibility, #13608) as a
standing policy held at every redemption, but not the parent switch
publicSharing.enabled — #14033 made that switch the same shape: held at
every redemption, not only at mint. Adds the sibling paragraph plus its
upgrade-note callout, placed after the eligibility paragraph so a reader
who has already understood the child predicate recognises the parent's
paragraph as the same shape one level up.


Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

content/docs/protocol/objectql/security.mdx

@@ -467,6 +467,31 @@ reclassification, widen the predicate rather than relying on the old
 behaviour.
 </Callout>
 
+**When `publicSharing.enabled` is off** (#14033). The block's own switch is
+the same standing-policy shape as `eligibility` above, one level up: it too
+is held at every redemption, not only at mint. Turning it off stops every
+existing link on the object immediately, with no revocation step to
+remember; turning it back on restores them, with no link needing to be
+re-minted. Turning the block off silences everything inside it —
+`eligibility` is not evaluated, `redactFields` is not computed — so the
+bypass some callers have at mint (a late schema scan, or a system context)
+buys only the mint: it still succeeds while the block is off, but what it
+mints does not resolve until the block is enabled. What an anonymous holder
+sees is the same "invalid or expired" answer `eligibility` already gives;
+the readable reason is written to the server log, never to the response.
+
+<Callout type="warn">
+**Upgrade note.** Before this, `publicSharing.enabled` gated only the mint —
+once a link was issued it kept resolving after the object's switch was
+turned off. Deployments upgrading across that change can feel it: links
+that used to keep serving after `enabled` was flipped off now stop
+immediately, and resume as soon as it is flipped back on. That is the
+intent — the alternative was a declared switch the platform did not hold —
+but there is no way to keep an already-minted link serving through the
+object being switched off; the object must stay opted in for its links to
+serve.
+</Callout>
+
 ---
 
 ## 6. Field-Level Encryption