fix: restrict media-search to the query, not just editable() after it

I1: query the attachments themselves author-restricted when the user
lacks edit_others_posts (PostGuard::ownPostsOnly, extracted from
ContentQueryAbility so content-query reuses the exact same rule)
instead of relying solely on a post-query editable() filter, which
could leak the existence of other users' attachments via an empty
page plus next_cursor. editable() stays as a backstop.

Also: M1 document that only status=inherit attachments are listed;
M2 tie-break ordering by ID (content-query and media-search) for
stable pagination; M3 no next_cursor once the last candidate was
examined; M4 reject an explicit non-image mime with missing_alt;
M5 additional coverage (posts_per_page, cursor offset pass-through,
invalid cursor, post_status/date/mime args); mime maxLength 100.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/PostGuard.php

@@ -119,6 +119,28 @@ final class PostGuard
         return $object;
     }
 
+    /**
+     * Whether a list/search query for this post type must stay restricted to the current
+     * user's own entries because they lack edit_others_posts. Filtering per row after the
+     * query (e.g. current_user_can('edit_post', $id)) is not enough on its own: without this,
+     * a restricted user's query still runs unrestricted, so a page can come back empty (or
+     * short) with a next_cursor that quietly reveals other users' entries exist without ever
+     * showing them – the same defect ContentQueryAbility guards against for content-query.
+     *
+     * @return int|null The current user id when restricted, null when the query may run
+     *                   unrestricted (author filter must then be left out entirely).
+     */
+    public static function ownPostsOnly(string $postType): ?int
+    {
+        $typeObject = get_post_type_object($postType);
+        $caps = is_object($typeObject) && isset($typeObject->cap) ? $typeObject->cap : null;
+        $capability = $caps !== null && isset($caps->edit_others_posts)
+            ? (string) $caps->edit_others_posts
+            : 'edit_others_posts';
+
+        return current_user_can($capability) ? null : get_current_user_id();
+    }
+
     public static function id(mixed $value): ?int
     {
         if (is_int($value)) {