fix(ogc): gate ogc_waterlevels on the well's release status

[jirhiker]

Stacked on #876 (→ #874 → #866). Base is fix/edr-instances-contract; GitHub retargets as the chain merges.

Fixes the inconsistency flagged in #876.

The hole

ogc_waterlevels filtered on the reading's release_status only:

WHERE o.release_status = 'public' AND o.value IS NOT NULL

So a well whose own release_status was draft or private still published its public readings through OGC API - EDR — with the well's name and coordinates attached to every row. ogc_water_chemistry has required the parent thing to be public since d9e0f1a2b3c4; water levels never got the same rule, which is why the two collections disagreed about the same well.

Now both branches of the union carry:

WHERE o.release_status = 'public'
  AND t.release_status = 'public'
  AND o.value IS NOT NULL

ogc_internal_waterlevels is deliberately untouched — it carries non-public records by design for authenticated staff clients, exactly as ogc_internal_water_chemistry does.

Data impact

No rows change on the dev database — 88,852 rows before and after, because no non-public well there carries readings. So this closes a hole rather than retracting published data. Worth confirming the same holds in production before deploy:

SELECT count(*) FROM ogc_waterlevels w
JOIN thing t ON t.id = w.thing_id
WHERE t.release_status <> 'public';

Downgrade

Restores the previous definition by importing z9a0b1c2d3e4 rather than copying its SQL, so the reverted view cannot drift from the definition of record — the approach b7c8d9e0f1a2 already established.

Tests

test_ogc_waterlevels_excludes_readings_from_a_non_public_well takes a public reading on a draft well and asserts three things: it is absent from ogc_waterlevels, still present in ogc_internal_waterlevels, and published again once the well goes public.

Verification

• uv run pytest --ignore=tests/transfers → 1099 passed, 81 skipped, 6 xpassed
• DROP_AND_REBUILD_DB=1 uv run behave tests/features --tags="@backend and @production and not @skip" → 9 features, 85 scenarios, 0 failed
• Migration applied and reverted against a freshly rebuilt database; view definition inspected via pg_get_viewdef both ways
• pre-commit (black, flake8) clean

🤖 Generated with Claude Code