Defensive publication: application-layer schema isolation that lexically denies foreign-schema references and re-admits cross-domain reads only through a mutation-free compiler that injects the authenticated-tenant predicate