fix: restrict media-search to the query, not just editable() after it

I1: query the attachments themselves author-restricted when the user
lacks edit_others_posts (PostGuard::ownPostsOnly, extracted from
ContentQueryAbility so content-query reuses the exact same rule)
instead of relying solely on a post-query editable() filter, which
could leak the existence of other users' attachments via an empty
page plus next_cursor. editable() stays as a backstop.

Also: M1 document that only status=inherit attachments are listed;
M2 tie-break ordering by ID (content-query and media-search) for
stable pagination; M3 no next_cursor once the last candidate was
examined; M4 reject an explicit non-image mime with missing_alt;
M5 additional coverage (posts_per_page, cursor offset pass-through,
invalid cursor, post_status/date/mime args); mime maxLength 100.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/PostGuardTest.php

@@ -85,6 +85,27 @@ final class PostGuardTest extends TestCase
         self::assertNull(PostGuard::statusStable(new WP_Post(['post_status' => 'publish'])));
     }
 
+    public function testOwnPostsOnlyReturnsTheCurrentUserWithoutEditOthersPosts(): void
+    {
+        Functions\when('get_post_type_object')->justReturn(
+            (object) ['cap' => (object) ['edit_others_posts' => 'edit_others_posts']]
+        );
+        Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'edit_others_posts');
+        Functions\when('get_current_user_id')->justReturn(7);
+
+        self::assertSame(7, PostGuard::ownPostsOnly('page'));
+    }
+
+    public function testOwnPostsOnlyReturnsNullWithEditOthersPosts(): void
+    {
+        Functions\when('get_post_type_object')->justReturn(
+            (object) ['cap' => (object) ['edit_others_posts' => 'edit_others_posts']]
+        );
+        Functions\when('current_user_can')->justReturn(true);
+
+        self::assertNull(PostGuard::ownPostsOnly('page'));
+    }
+
     public function testPostTypeChecksAvailabilityAndCapability(): void
     {
         $object = (object) ['cap' => (object) ['create_posts' => 'edit_pages']];