test(search): restore the generic internal-id-field guard

The prune replaced a generic "no PUBLIC_FIELDS name ends in _id" invariant
with a fixed list of the seven names that were dropped. That list catches
the seven; nothing catches the eighth.

Dropping write-only *_id fields from the query surface is the whole point
of the schema change earlier in this branch, so the generic form is what
guards the class against recurrence. Both tests coexist: the list pins
that specific names stay unregistered, this pins that no new one leaks in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/documents/tests/search/test_registry.py

@@ -3,6 +3,7 @@ from whoosh_compat import FieldKind
 from whoosh_compat import FieldRegistry
 from whoosh_compat.fields import ResolvedField
 
+from documents.search._fields import PUBLIC_FIELDS
 from documents.search._registry import get_field_registry
 
 
@@ -35,6 +36,16 @@ class TestFieldRegistry:
         ):
             assert name not in registry
 
+    def test_no_queryable_field_name_ends_in_id(self) -> None:
+        # The list above names the seven that were dropped; this catches the
+        # eighth. Internal *_id columns are written for permission filtering
+        # and joins, and whoosh only exposed them as query fields by accident,
+        # so a new one reaching the query surface is a leak rather than a
+        # feature. Checked against PUBLIC_FIELDS rather than the registry so
+        # an internal field is caught where it is declared.
+        leaked = [f.name for f in PUBLIC_FIELDS if f.name.endswith("_id")]
+        assert not leaked, f"internal id fields reached the query surface: {leaked}"
+
     def test_type_alias_resolves_to_document_type(
         self,
         registry: FieldRegistry,