[MantisCartography]

Summary

Two contract fixes that prod needs together:

1. Send visibility instead of legacy is_public (#22, already on main). The backend hard-rejects is_public on /synthesis/landscape and /synthesis/github since MantisAPI #1958 (Jul 2026). Every SDK-driven space creation against prod has been 400-ing since; the repo_radar daily task is the most visible victim (runs green, produces nothing — its data is from June 20).

2. Land the internal-service secret auth that prod already runs. The current prod pin ca8bab2 comes from the open PR #12 branch, not main. The MantisAPI backend (middleware.py) now fail-closes internal-service auth without X-Internal-Secret in production — a main-based pin without these commits would lose radar's backend auth entirely. These 5 commits are Pranava's PR #12 work (cherry-picked unchanged, same SHAs' content), which has been running in production since Aug 7 but was never merged to main. This PR merges that content so main = prod behavior + the visibility fix.

Why cherry-pick instead of merging PR #12 directly

PR #12's branch is based on an older main and its head 74af9dc predates #22; merging both would require PR #12 to be rebased. This PR applies the same 5 commits (identical patch content) on top of current main + #22, then runs the combined test suite.

Verification

Full test suite on this branch: 78 passed (72 on main after #22, plus 6 auth tests from the PR #12 commits: secret required, secret sent, token redaction, cookie preservation with incomplete internal settings).

After merge

Bump SDK_COMMIT in MantisAPI src/mantis4mantis/repo_radar_task.py to the merge SHA (tracked in the MantisAPI regression issue).