Audit version visibility

Problem

Private history is available to the wrong audience.

Check access through the same workspace rules as the current draft.

A public preview link should not expose internal rejected alternatives.

Does every historical read preserve the access boundary?