Selector loads the entire catalog when an agent has no scope subscriptions
## Problem
Follow-up to:
#3586294
Parent:
#3586310
`AiContextSelector::getPrefilteredPublishedItemIds()` returns NULL when
`$scopeSubscriptions` is empty, so the chunk loop loads **every published
context item** (full entities including content fields) on every AI
request. This hits the very common "global items only" agent configuration.
With thousands of items that's dozens of chunked queries, thousands of
entity hydrations, and thousands of per-item plugin
`matchesCurrentContext()` calls per request — the `match_all` broad-scan
warning only logs, it doesn't avoid the work.
## Resolution
For `SELECTION_MODE_MINIMAL` with no subscriptions, replace the full
catalog scan with a targeted prefilter. Only candidates that can
contribute in this mode are loaded:
1. **Global items** — from the scope index.
2. **Unindexed items** — published items with no scope index rows (includes
target-entity-only items and unscoped items). Resolved via a LEFT JOIN
anti-join on the entity data table.
3. **Current target-entity items** — explicit DER matches for the active
entity context (covers items with both indexed subscription scope and a
target entity reference).
4. **Custom non-subscription scope items** — items indexed under enabled
scope plugins where `supportsSubscriptions()` is FALSE.
`SELECTION_MODE_MATCH_ALL` with no subscriptions continues to use the full
catalog scan.
Implemented in [!210](https://git.drupalcode.org/project/ai_context/-/merge_requests/210).
## AI usage
- [x] AI assisted issue
issue