Avoid Full Published-ID Scans Before Scope Prefiltering
## Problem/motivation
Follow-up to:
#3586202
_**Verify this is still an issue and the solution approach before proceeding**_
`AiContextSelector::getPrefilteredPublishedItemIds()` loads all published item
IDs before applying `AiContextScopeIndexService::getItemIdsByScope()`.
That means scoped agent selection can still begin with a full-catalog ID query
and a large in-memory ID array, even though the scope index exists to narrow the
candidate set.
This should be fixed before RC1 because the common subscribed-agent path should
scale with the matching scope set, not the total published context catalog.
## Solution
- Move published/access narrowing into the indexed query path where possible.
- Add a selector/index method that returns scoped published candidate IDs
without first materializing every published item ID.
- Preserve global-item inclusion separately, but avoid using the full published
set as the default candidate universe.
## Tasks
- Check against other issues to make sure it wasn't separately reported
- Verify this is still an issue before proceeding
- Verify the solution approach before proceeding
- Update code
- Review and test
## AI usage disclosures
- [x] AI Assisted Issue
- [ ] AI Assisted Code
- [ ] AI Generated Code
issue