Publish gate silently disables agent-created redirects now that redirect entities are publishable

Problem/Motivation

Redirect module dev-1.x made Redirect a publishable entity (EntityPublishedInterface, published key enabled). McpModerationGate governs publishable entities fail-closed, so redirects became governed by fall-through: under a deny-publish profile the presave backstop silently unpublishes every agent-created redirect. The create reports success, the redirect never fires, and nothing logs. On one production site this accumulated five dead enabled=0 redirects in two weeks, surfacing as unexplained 404s on renamed URLs.

A redirect's enabled flag is routing metadata like path_alias (already exempt): it means "is this mapping active", and the target's own access decides visibility. The agent-risk axis for redirects is the target, which deny_external_redirects already constrains.

Resolution (shipped in 1.10.0)

Per-entity-type config override entity_rules..allow_publish (mirrors the existing allow_delete), defaults unchanged and fail-closed — redirects stay governed unless a site opts out in config. The presave backstop's forced unpublish now writes a publish_gate_backstop audit row and a watchdog warning instead of flipping silently.

Fix and tests: https://github.com/Wilkes-Liberty/mcp_sentinel/pull/44

Marking Fixed: the change shipped in the 1.10.0 release.