news: close the remaining no-paywall bypass paths (Codex audit)

queries.feed was the main chokepoint, but several discovery paths have their own
SQL. Apply the shared source exclusion to all of them so "no paywalls" is truly
site-wide:
- briefs.build_daily_brief: EXCLUDE paywalled candidates (was: demote) — never
  stored in a new brief.
- queries.brief: stored-brief retrieval (covers /today + /api/brief) filters the
  paywalled source.
- digest.digest_items + followed_digest_items: the morning email + "from what you
  follow" omit paywalled sources.
- sitemap(): paywalled article pages excluded from the sitemap.
All reuse queries.paywalled_source_ids (admin override still wins).

Regression tests (test_paywall_exclusion.py): never stored in a new brief; /today
+ digest omit it; followed-source email omits it; Saved retains it; 'free'
override restores eligibility. 423 backend tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

goodnews/briefs.py

@@ -15,11 +15,11 @@ def build_daily_brief(
 ) -> int:
     target_date = brief_date or local_today()
 
-    # Compose the selection first so we can tell whether anything actually
-    # changed. A calm daily brief shouldn't repeatedly hand the reader a locked
-    # door: push paywalled candidates below readable ones (stable sort) first.
+    # Compose the selection first so we can tell whether anything actually changed.
+    # A calm daily brief never hands the reader a locked door: paywalled-source
+    # candidates are excluded outright (no unreadable news), not just demoted.
     rows = _candidate_articles(conn, target_date, window_days)
-    rows = sorted(rows, key=lambda r: is_paywalled_for_source(r["canonical_url"], r["paywall_override"]))
+    rows = [r for r in rows if not is_paywalled_for_source(r["canonical_url"], r["paywall_override"])]
     selected = _select_diverse(rows, limit)
     selected_ids = [row["id"] for row in selected]